Memory device storing identifying information and memory card including the same

ABSTRACT

In a memory system using a removable recording medium and data stored in the recording medium, identifying information for identifying each recording medium from others is held in the recording medium, and when data stored in the recording medium is used, the identifying information of the recording medium is required. As a result, when a flash memory card, etc. is used, a copyright is reliably protected.

The present reissue application is a continuation reissue application ofreissue Ser. No. 10/931,247, filed Aug. 31, 2004, which is a reissueapplication of U.S. Pat. No. 6,446,177, and claims priority fromJapanese Patent Application No. 10-282527, filed Oct. 5, 1998, andJapanese Patent Application No. 11-205352, filed Jul. 19, 1999. Morethan one reissue application has been filed for the reissue of U.S. Pat.No. 6,446,177. The reissue applications are application Ser. No.10/931,247 and the present application Re. 42,398.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates to a memory system using semiconductor memory tobe used for the purpose of protecting copyrights. The invention alsorelates to a control method of electrically erasable and programmablenonvolatile semiconductor memory, especially useful for use to NANDEEPROM (electrically erasable and programmable read-only memory).

2. Description of the Prior Art

A flash memory card FMC as shown in FIG. 1 has become of major interestlately as a recording medium of portable information devices such asdigital still cameras, PDA (personal digital assistant), for example.The flash memory card FMC is a thin plastic package having formed aslight recess holding a built-in flash memory device FM with 22-pinplanar electrodes. The flash memory card FMC can exchange data with ahost system (personal computer) when electrically connected to the hostsystem via a connector. For example, using a PC card adapter, any fileon the flash memory card can be readily delivered to the personalcomputer.

However, since a memory system using the flash memory FM can easily copyany files including copyrighted ones, such as musical data, andinfringement of copyrights has been an issue of this system.

Apart from this, electrically rewritable EEPROM is known as a sort offlash memory. Especially, NAND EEPROM using a NAND cell made by seriallyconnecting a plurality of memory cells has attracted attention as beingavailable for high integration. A memory transistor of NAND EEPROM, hasa FETMOS structure in which a floating gate (charge storage layer) and acontrol gate are stacked on a semiconductor substrate via an insulatingfilm. Then, a plurality of memory transistors are serially connected,with a source and a drain commonly used by every two adjacent memorytransistors, to form a single-unit NAND cell, and the NAND cell isconnected to a bit line. A number of such NAND cells in a matrixarrangement form a memory array.

A memory array of NAND EEPROM is made up of a plurality blocks. If asingle NAND cell has 16 stages, then each block includes 16 word linesfor selecting the NAND cells and memory cells within a range where theseword lines are continuous. This one block is the minimum unit ofcollective erasure in flash memory configured to erase datacollectively. Each range with memory transistors under one word line isnormally called one page.

EEPROM flash memory is now being remarked as not only being rewritablelike DRAM but also maintaining storage of data by its nonvolatility evenafter power supply is cut. In applications of EEPROM flash memory, thereis the demand for limiting free rewriting in a part of its memory regionand for designing it as OTP (one time PROM) permitting data writing onlyonce.

The demand arises, for example, in devices having a flash memory systemfor intake and transfer of musical data, for example, which are subjectsof the serious copyright problem, when duplication of musical data mustbe limited to a certain extent. More specifically, in a memory systemusing EEPROM flash memory, it is requested to store a mark data in anOTP region as an irreversible change of state of a chip every time whenthe EEPROM flash memory is accessed, accompanied by the task ofrewriting data thereon, and to permit the irreversible change of stateonly predetermined times.

SUMMARY OF THE INVENTION

It is therefore an object of the invention to provide a memory systemensuring protection of copyrights when a flash memory card, for example,is used.

Another object of the invention is to provide a control method ofnonvolatile semiconductor memory including an OTP in a part of itsmemory region, which is capable of writing a mark data reliablypreventing erroneous writing, etc. in the OTP region and clearlymaintaining the boundary between a written region and a non-writtenregion, and hence reliably storing irreversible changes of state.

According to the invention, there is provided a memory systemcomprising:

-   -   a recording medium storing a data file and identifying        information for restricting the condition for using the data        file; and    -   a system apparatus permitting the recording medium to be        removably set therein and requiring the identifying information        when reading and using thereon the data file stored in the        recording medium.

According to the invention, there is further provided a memory systemcomprising:

-   -   a recording medium storing a data file acquired by download from        a distribution center together with identifying information        incorporated into the data file for restricting the condition        for using the data file; and    -   a system apparatus permitting the recording medium to be        removably set therein and requiring the identifying information        when reading and using thereon the data file stored in the        recording medium.

According to the invention, there is further provided a recording mediumwhich can be set in a system apparatus and can be removed from thesystem apparatus, comprising:

-   -   a data storage field for storing a data file; and    -   an identifying information storage field for storing identifying        information for restricting the condition for using the data        file, the identifying information required when the system        apparatus reads and uses the data file.

According to the invention, there is further provided a system apparatusin which a recording medium is set and used, and the recording mediumonce set is removed, characterized in:

-   -   the recording medium storing a data file and identifying        information for restricting the condition for using the data        file; and    -   the system apparatus requiring the identifying information when        reading and using the data file stored in the recording medium.

According to the invention, there is further provided a system apparatusin which a recording medium is set and used, and the recording mediumonce set is remove, characterized in:

-   -   an identifying information hold portion which holds identifying        information for identifying the system apparatus; and    -   a judge portion which approves the use of the data file stored        in the recording medium when a predetermined relation is        established between identifying information incorporated into        the data file stored in the recording medium and identifying        information held in the identifying information hold portion,        but does not approve the use of the data file when the        predetermined relation is not established.

According to the invention, there is further provided a control methodfor controlling nonvolatile semiconductor memory having a memory cellarray made of an arrangement of electrically rewritable nonvolatilememory cells, a part of the memory cell array forming a state changestorage field permitting data to be written only once, said state changestorage field including a plurality of pages each divided into aplurality of unit areas, comprising:

-   -   a first step for detecting that the nonvolatile semiconductor        memory experienced a predetermined operation causing a change of        state thereof; and    -   a second step for writing a mark data in one of the unit areas        in the state change storage field when the predetermined change        of state is detected.

According to the invention, there is further provided nonvolatilesemiconductor memory having a memory cell array made up of anarrangement of electrically rewritable nonvolatile memory cells,comprising:

-   -   an ordinary field made up of a part of the memory cell array to        store a data file; and    -   a state change storage field made up of another part of the        memory cell array and including a plurality of pages each        divided into a plurality of unit areas, the state change storage        field permitting data to be rewritten only once, and upon any        operation causing a predetermined change of state to the data        file, a mark data is written in one of the unit areas.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be understood more fully from the detaileddescription given herebelow and from the accompanying drawings of thepreferred embodiments of the invention. However, the drawings are notintended to imply limitation of the invention to a specific embodiment,but are for explanation and understanding only.

FIG. 1 is a diagram showing an outer aspect of a flash memory card;

FIG. 2 is a diagram showing the structure of a physical block in 16-MbitNAND flash memory;

FIG. 3 is a diagram showing the structure inside a data region in the16-Mbit NAND flash memory;

FIG. 4 is a diagram showing the structure of a logical block/physicalblock conversion table in the 16-Mbit NAND flash memory;

FIG. 5 is a diagram showing the structure of the physical block in the16-Mbit NAND flash memory (when the leading block is not a defectiveblock);

FIG. 6 is a diagram showing the structure of the physical block in16-Mbit NAND flash memory (when the leading block is a defective block);

FIG. 7 is a diagram showing the structure of a CIS region shown in andFIG. 5 and FIG. 6;

FIG. 8 is a diagram showing a general aspect of the first embodiment ofthe invention;

FIG. 9 is a diagram showing a general aspect of the second embodiment ofthe invention;

FIG. 9A is a diagram explaining an aspect when composing a cipher keyfrom identifying information and deciphering cipher file by using thecipher key;

FIG. 10 is a diagram showing a general aspect of the second embodimentof the invention;

FIG. 10A is a diagram showing a general aspect of the third embodimentof the invention;

FIG. 10B is a diagram showing a general aspect of a modified version ofthe third embodiment of the invention;

FIG. 10C is a diagram showing a flash memory card in accordance with aPC card ATA interface employing the third embodiment of the invention;

FIG. 11 is a diagram showing a general aspect of the fourth embodimentof the invention;

FIG. 12 is a diagram showing a general aspect of the fourth embodimentof the invention;

FIG. 13 is a diagram showing a general aspect of the fourth embodimentof the invention;

FIG. 14 is a diagram showing a general aspect of the fifth embodiment ofthe invention;

FIG. 14A is a diagram showing a general aspect of the sixth embodimentof the invention;

FIG. 14B is a diagram showing a general aspect of the seventh embodimentof the invention;

FIG. 15 is a diagram showing signal waveforms appearing in an ID readmode of a conventional flash memory card;

FIG. 16 is a diagram showing signal waveforms appearing in an ID readmode of a c flash memory card according to the seventh embodiment of theinvention;

FIG. 17 is a diagram showing signal waveforms appearing in an ID readmode of a c flash memory card according to the seventh embodiment of theinvention;

FIG. 18 is a circuit diagram showing a fuse circuit mounted into a flashmemory card;

FIG. 19 is a diagram showing the structure of a physical block of aflash memory card according to the eighth embodiment of the invention;

FIG. 20A is a diagram showing a row decoder circuit of flash memoryaccording to the invention;

FIG. 20B is a diagram showing a transfer gate circuit connecting a busline of peripheral circuits and a word line;

FIG. 21A is a diagram showing identifying information and complementinformation in a redundancy block in the ninth embodiment of theinvention (before being changed);

FIG. 21B is a diagram showing identifying information and complementinformation in a redundancy block in the ninth embodiment of theinvention (after being changed);

FIG. 22 is a diagram showing a memory space of flash memory withdefective bits randomly generated, in the tenth embodiment of theinvention;

FIG. 23 is a diagram explaining a setup for copyright protection in thetwelfth embodiment of the invention (when moving an approved file of aliterary work);

FIG. 24 is a diagram explaining a setup for copyright protection in thetwelfth embodiment of the invention (when unapproved copy of the file ofthe copyright work is attempted);

FIG. 25 is a diagram showing the structure of NAND EEPROM flash memoryused in the twelfth embodiment of the invention;

FIG. 26 is a diagram showing a block structure of a memory cell array inthe same flash memory;

FIG. 27 is a diagram showing a specific structure of a block in the sameflash memory;

FIG. 28 is a diagram showing the structure of a row decoder in the sameflash memory;

FIG. 29 is a diagram showing data write operation timing in the sameflash memory;

FIG. 30 is a diagram showing bias conditions for data write in the sameflash memory;

FIG. 31 is a diagram showing data read operation timing in the sameflash memory;

FIG. 32 is a diagram for explaining a preferable example of data writesequence within NAND cell in the same flash memory;

FIG. 33 is a diagram for explaining an undesirable example of data writesequence within a NAND cell in the same flash memory;

FIG. 34 is a diagram showing a sequence of mark data write into OTPblocks in the same embodiment;

FIG. 35 is a diagram showing an address increment flow for writing themark data in the same embodiment;

FIG. 36 is a diagram showing a control flow (first half) for searchingout a space area in OTP blocks in the same embodiment;

FIG. 37 is a diagram showing a control flow (second half) for searchingout a space area in OTP blocks in the same embodiment;

FIG. 38 is a diagram for explaining a specific procedure for writingmark data into an OTP block in the same embodiment;

FIG. 39 is a diagram for explaining an example in which a stableboundary area is maintained upon mark data write into OTP blocks in thesame embodiment;

FIG. 40 is a diagram for explaining an example in which a unstableboundary area is removed upon mark data write into OTP blocks in thesame embodiment;

FIG. 41 is a diagram for explaining another example in which a unstableboundary area is removed upon mark data write into OTP blocks in thesame embodiment;

FIG. 42 is a diagram showing a control flow (first half) for writingmark data into OTP blocks in the same embodiment;

FIG. 43 is a diagram showing a control flow (second half) for writingmark data into OTP blocks in the same embodiment;

FIG. 44 is a diagram showing the circuit structure of AND flash memoryapplied present invention, particularly the twelfth embodiment; and

FIG. 45 is a diagram showing the circuit structure of DINOR flash memoryapplied present invention, particularly the twelfth embodiment.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

A small flash memory car FMC shown in FIG. 1 is explained as an exampleof storage mediums. This flash memory card FMC is made up of a thinplastic package having a slight recess, and flash memory FM having22-pin flat electrodes is buried in the recess. In the embodiment shownhere, flash memory called NAND EEPROM is used as the flash memory FMmounted in the flash memory card FMC. In flash memory FM of this type, aphysical format specification directing a data storage method isdetermined for ensuring compatibility of data in the market.

As shown in FIG. 2, in case of 16-Mbit NAND flash memory, the flashmemory is divided into 512 physical memory blocks Block 0 through Block511. Each block is the minimum unit for erasure. Each memory block isdivided into 16 pages Page 0 through Page 15. Each page is the basicunit for write and read. Each page is made up of 264 bytes. Among them,256 bytes form a data field DT and the remainder 8 bytes form aredundancy field RD. The data field DT is the area for storing userdata, and the redundancy field RD is the area for storing errorcorrection codes, management information, and so forth.

In personal computers, etc., data is typically managed in the unit ofeach sector (512 bytes). Also in this flash memory, data is basicallymanaged in the unit of 512 bytes. Therefore, two pages including an evenpage and an odd page are used as one pair.

Internal data arrangements of the data field DT and the redundancy fieldRD are shown in FIG. 3. In the data field DT and the redundancy fieldRD, a before-use normal area is set as “FFh”. Explained below aremeanings of individual bytes.

Data Status Area in the data field DT stores data of first half 0 to 255bytes in the sector data of 512 bytes. Data Area-2 in the data field DTstores data of second half 256 to 511 bytes in the sector data of 512bytes.

Data Status Area in the redundancy field RD is the area for storing dataindicating whether the data stored in the data field in the common pageis normal or not normal. This Data Status Area is set as “FFh” when thedata in the data fields of the even page and the odd page forming a pairis normal, but it is set as “00h” when an improper data is written. Thatis, a single Data Status Area is used for setting of an even page and anodd page paired.

Block Status Area in the redundancy field RD is the area for storingdata indicating whether the data stored in the memory block is normal ornot normal. This Block Status Area is set as “FFh” when the data in thedata fields of the memory block is normal, but it is set as “00h”(initially defective block) or “F0h” (afterward defective block) when animproper data is written. Therefore, if two or more bits exhibit “0” inthis Block Status Area, then the memory block can be judged defective.In a common memory block, the same value is written in all Block StatusAreas. That is, as shown in FIG. 2, in a common memory block, the samevalue is set in all Block Status Areas on Page 0 through Page 15.

As shown in FIG. 3, Block Address Area-1 in the redundancy field RD isthe area for storing logical block address information about the memoryblock. In a common memory block, the same value is written in any BlockAddress Area-1. This results in that, in Block Address Area-2, the samelogical block address information as that of Block Address Area-1 iswritten. For control of the flash memory card FMC used here, anadditional write procedure is employed, in which, upon data renewal,renewal data is written in a previously erased memory block area, andprevious data is erased from a memory block area where the previous dataexists. This means that the physical block address where the datacorresponding to a certain logical block address exists is not fixed,but always moves in the memory.

Therefore, as explained above, Block Address Area-1, -2 in theredundancy fields RD of each of memory blocks Block 0 through Block 511store logical block address information identifying particular logicalblocks corresponding to their own storage data. Typically, immediatelyafter the supply of power, by searching Block Address Areas-1 and/orBlock Address Areas-2 in all physical blocks Block 0 through Block 511,a conversion table of logical blocks and physical blocks as shown inFIG. 4 is made on a system RAM. Once the conversion table is made,location of a physical block corresponding to a certain logical blockcan be readily known with reference to the conversion table. Therefore,it is sufficient to conduct the search of all memory blocks only oncesubsequently to power-ON. Needless to say, if there occurs a change inlocation of a physical block due to data renewal thereof, then theconversion table shown in FIG. 4 is renewed to be available for a nextaccess.

As shown in FIG. 3, ECC Area-1 in the redundancy field RD is an area forstoring ECC (error correction code) of three bytes for the data field DT(256 bytes) on an even page. ECC Area-2 is an area for storing ECC ofthree bytes for the data field DT (256 bytes) of an odd page. ECC is acode for correcting an error. The system uses ECC for error correctionto judge whether a data read out from the data field DT includes anerror or not, and if any error exists in the data field DT, it cancorrect the error.

FIG. 5 is a diagram re-arranging the content of FIG. 2 from anotherpoint of view. As shown in FIG. 5, CIS (card information structure) isdefined in the leading block among the memory blocks Block 0 throughBlock 511. As explained above, for the flash memory card FMC, a datastorage method is determined for ensuring compatibility in the market.CIS mentioned above is an identifying area for judging whether the flashmemory card FMC is in accordance with the predetermined data storagemethod. CIS is located in the leading block among effective blocks. Asshown in FIG. 5, if the first memory block Block 0 is not defective,then CIS is located in the leading memory block Block 0. If the leadingmemory block Block 0 of the chip is defective, then CIS is located inthe second memory block Block 1 as shown in FIG. 6.

As shown in FIG. 7, CIS is divided into two fields A and B. Field A is afixed data field. Leading 10 bytes of the field A are used to judgeconsistency or inconsistency with the predetermined data storage method.Upon power-ON, the system reads leading 10 bytes of the CIS block, andif the value coincides with a predetermined value, it considers theflash memory card FMC to be in accord with the predetermined datastorage method, and progresses the processing. If the system cannot readpredetermined 10 bytes, it considers the flash memory card FMC to be aproduct of an unknown format, and interrupts the subsequent processingto prevent destruction of data.

The CIS field is an area the system (for example, controller in a PCadapter card) is exclusively allowed to make reference of, and ordinaryend users cannot look. For example, when a file is stored in the flashmemory card FMC through the PC adapter car, the file is stored, using asite other than the CIS field, involving a file management field (masterboot sector, partition boot sector, FAT, directory, etc.) and the filedata itself altogether. Therefore, the CIS field is not visible fromabove the personal computer unless using a special means.

Field B, the other field of CIS, is an area permitting any arbitrarydata to be set, but no end user can de such setting or arbitrary data.Upon shipping the flash memory card FMC, and by using a special toollater, data is set in the field B.

Next explained is an embodiment for protecting copyright on a flashmemory card having the above-explained regulation.

Literary works include all matters lawfully originating copyrights, suchas musical data like classic music and popular music, English or otherlanguage text data, character data like literature, magazines andnewspapers, audio data of performances, interviews, comical talkentertainment, etc. Other data lawfully originating no copyright butdesirable to be protected in some way such as copy protect, for example,may be also treated similarly. In the explanation given below, these arecollectively referred to as literary works or contents.

First Embodiment

The first embodiment of the memory system according to the invention isexplained below. This embodiment is directed to flash memory for saleafter storing literary works.

There are various ways for copyright protection. In this embodiment,identifying information is previously written in the CIS filed (field Bin FIG. 7 permitting any arbitrary data to be set) of the flash memorycard FMC. Although details will be explained later, the identifyinginformation is one for restricting conditions for enabling the use of afile of a literary work stored in the flash memory FM. This identifyinginformation may be named as identifying code.

As shown in FIG. 8, an end user can listen to music or watch images bysetting the flash memory card FMC in the system apparatus SYS1 accordingto the first embodiment (for example, music reproducing apparatus, imagedisplay apparatus, etc.). Additionally, the end user can remove theflash memory card FMC from the system apparatus SYS1 and set anotherflash memory FM therein.

The system apparatus SYS1 shown here expects the row of letters “ABC” asthe identifying information of CIS in the flash memory card FMC. Theexpected value “ABC” is held in identifying information memory IIM ofthe system apparatus SYS1.

Here are taken two kinds of flash memory cards FMC, namely, a flashmemory card FMC(A) having “ABC” and a flash memory card FMC(B) having“DEF” as the identifying information on CIS. Actually, CIS identifyinginformation is not limited to those of three letters, but its number ofletters (including numbers) is preferably many as possible. Furthermore,the CIS identifying information may be created by using random numbers.In the example shown here, the information is made up of three lettersfor simplicity.

In the case of FIG. 8, since the system apparatus SYS1 expects the rowsof letter “ABC” as the CIS identifying information, when the flashmemory card FMC(A) is inserted into the system apparatus SYS1, the flashmemory card FMC(A) can be used normally. However, since the flash memorycard FMC(B) does not have the expected identifying information “ABC”, itcannot be used in the system apparatus SYS1. This judgement is executedby a judge means JD in the system apparatus SYS1.

The identifying information is not disclosed generally. In this case,therefore, only flash memory cards FMC sold with “ABC” written as theidentifying information can be used in the system apparatus SYS1, andcopyright of the literary work in the flash memory card FMC isprotected.

Regarding the flash memory card FMC(B) judged non-usable, many levelsfor rejection of its use are employable. In case of music, for example,in addition to the level completely disabling a user to listen to music,it is possible to employ the level permitting a user to listen to a partof the music. This will be employable, for example, when letting a userto listen to a part thereof for the purpose of promotion.

If the system apparatus SYS1 is an image display apparatus, in additionto the mode of protection absolutely disabling a user to watch, thereare many ways of protection, such as giving a part of an image, givingonly a scrambled image (like a mosaic image), and giving only a smallthumb-nail image, for example. Alternatively, it may be designed toprovide very high-fidelity images on the system apparatus SYS1 in caseof an original flash memory card FMC(A) while providing onlylow-fidelity, rough images on the system apparatus SYS1 in case of acopy (unapproved) flash memory card FMC(B).

It is also possible to permit the use of a certain function with theoriginal flash memory card FMC(A) and to reject the use of a certainfunction otherwise. In case of music, for example, certain limitationmay be added to functions of the system apparatus SYS1, such aspermitting the use of the queue function similarly to CD players with anoriginal flash memory card FMC (A) but rejecting the same function withother flash memory cards FMC. That is, if any difference exists betweenthe use of the flash memory card FMC(A) having expected properidentifying information and other flash memory cards FMC, the purposewill be accomplished.

In the above-explained method, however, only if the expected identifyinginformation “ABC” is written, all such flash memory cards FMC areregarded as proper flash memory card, and there is the possibility thathonesty of the file stored thereon cannot be judged. That is, it mayoccur that, once a user purchases a flash memory card FMC withidentifying information “ABC”, he can acquire copy data onto the flashmemory card FMC from an unfair WEB site on the Internet and can use itthereafter.

Additionally, when the expected identifying information is definitelydetermined in the manufacturing process of the system apparatus SYS1 (incase of this embodiment, “ABC”), original flash memory cards FMC havingidentifying information other than “ABC” cannot be sold. This problemwill be overcome by using some means to have the system apparatus SYS1function to change the expected value or add an additional expectedvalue. For example, software for changing the expected value of thesystem apparatus SYS1 or adding an additional expected value may beadded to original flash memory cards to use it for changing the expectedvalue of the system apparatus SYS 1 or adding an additional expectedvalue. Alternatively, such software may be installed in the systemapparatus SYS1 while providing only the changed expected value on suchflash memory cards FMC under some engagement. Needless to say, insteadof changing the expected value, depending on information on a flashmemory card, the system may be designed to change the expected value ofthe system apparatus SYS1, for example, by changing the system apparatusSYS1 to a personal computer, or the like, via a cable, for example, andby operating the personal computer. That is, the system may be addedwith the function for changing the expected value of the systemapparatus SYS1 or adding an additional expected value by some procedureafter shipment of the system apparatus SYS1.

Second Embodiment

Next explained is the second embodiment of the memory system accordingto the invention. Similarly to the first embodiment, this embodiment isalso directed to flash memory for sale after storing literary works.

A general aspect of the second embodiment is shown in FIG. 9. In thisembodiment, identifying information is stored in the field B of CIS (seeFIG. 7) in the flash memory card FMC, and simultaneously, informationrelated to the identifying information stored on CIS is taken into thefile itself to be stored in the flash memory card FMC.

For example, in the case where the identifying information of CIS in theflash memory card FMC(A) is “ABC” as shown in FIG. 9, informationrelated to the identifying information “ABC” is introduced into the fileto be stored in the flash memory card FMC(A). For simplicity, here isshown a case where the row of letters “ABC”, in the same form, is takenalso as the identifying information in the file.

A system apparatus SYS2 reads identifying information from CIS of theflash memory card FMC(A). In the case of FIG. 9, identifying information“ABC” is read into the system apparatus SYS2. After that, the systemapparatus SYS2 reads identifying information from the file stored in theflash memory card FMC. If “ABC is read out as the identifyinginformation from the file, the system apparatus SYS2 acknowledges thefile as the original file.

In the case where other information such as “DEF” instead of “ABC” isread out as the identifying information from the predetermined field ofthe file, like the flash memory card FMC (B), the system apparatus SYS2prohibits or restricts the use of the flash memory card FMC(B). That is,the system apparatus SYS2 regards the file as copied from another flashmemory card FMC through a personal computer, for example, and prohibitsor restricts its use on the system apparatus SYS2. Details of therestriction are substantially the same as those explained with the firstembodiment.

Judgement on consistency or inconsistency between the CIS identifyinginformation of the flash memory card FMC and the identifying informationin the file is executed by a judge means JD in the system apparatusSYS2.

A difference of the second embodiment from the first embodiment lies inenabling the use of a flash memory card FMC(C) in the system apparatusSYS2 when identifying information in CIS coincides with the identifyinginformation in the file even if these pieces of identifying informationare unknown when the system apparatus SYS2 is manufactured. For example,in the case where the system apparatus SYS2 is a music player, theidentifying information in the CIS field corresponds to the name of asinger or an album. In the embodiment shown here, since the systemapparatus SYS2 can reproduce any piece of music which can be stored inthe original flash memory card FMC even after a new singer appears or anew album issues, they can be put on sale without problems. That is, anyflash memory card FMC in which the identifying information in CIS andthe identifying information in the file coincide can be used in thesystem apparatus SYS2.

The embodiment shown here is not limited to the above-explained method.It is sufficient to establish an appropriate relation between the flashmemory card FMC and the literary work. The above example has beenexplained as taking the row of letters in the CIS field unchanged intothe file. However, the embodiment can be modified in various modeswithin the scope of the invention for example, the row of letters to betaken into the file need not fully coincide with the row of lettersstored in the CIS field. For “ABC”, the inverted form “CBA” may bestored as well. “BCD” shifted from “ABC” by one alphabetical letter maybe stored, or a form shifted by two or more letters may be stored. It isalso possible to assign numerals to individual letters in “ABC” in thealphabetical order to store as “123”. Only if a relation according tosome regulation is established between the identifying information inthe CIS field and the identifying information in the file, it meets theconcept of the invention. Additionally, it is not necessary that theidentifying information in the file coincides with the identifyinginformation in CIS in number of letters. Also when “ABCDEF” or “ABCABC”,for example, is stored by changing the number of letters from “ABC”, itis acceptable as far as some regularity is established.

For further improvement of the reliability, instead of simply storingidentifying information in the file from the CIS field, informationrelates to the identifying information in the CIS field may be cipheredtogether with other data in the file, for example. When it is simplystored in the file, there arises the possibility that the storageposition of the information related to the identifying information islocated by comparing file data of several flash memory cards FMC havingother identifying information. To prevent it and improve thereliability, differences among several flash memory cards FMC may beincreased by ciphering or other method over a relatively wide area. Acipher key for deciphering the cipher file may be provided in ASIC(application specific integrated circuit), for example, in the systemapparatus SYS2. Alternatively, the cipher key itself may be soldtogether with the literary work. The information related to theidentifying information in the CIS field need not exists in each file.Another file related to the content of the literary work (for example, afile storing the title of music) may have the informationrepresentatively.

Taking this embodiment into consideration, assume here, for example,that a person having purchased a flash memory card FMC storing aliterary work through a proper route once transferred the file of theliterary work stored in the flash memory card FMC to a personalcomputer, and again transferred this file from the personal computer toanother blank flash memory card FMC. In this case, the file of theliterary work can be transferred normally. However, on the flash memorycard FMC to which the file was re-transferred, the identifyinginformation in the CIS field is not regularly related to the identifyinginformation in the transferred file. Therefore, the system apparatusSYS2 can readily judge the file stored in the flash memory card FMC tobe an unapproved copy. As a result, the use of the flash memory card FMCwith the unapproved copy is restricted.

This is a result of an ingenious use of the mechanism in which, whentransferring data to a personal computer by using a general purposeadapter card, for example, the controller in the adapter card makesaccess to the CIS field to confirm whether it meets the standard formator not, but software on the personal computer, etc. cannot access to theCIS field unless using a special method, and even though the file can betransferred, identical information in the CIS field is never transferredto other flash memory cards FMC.

A general aspect of this example is shown in FIG. 10. In an originalflash memory card FMC(D), “ABC” is stored as identifying information inthe CIS field, and “ABC” is stored also as the identifying informationin the file. Under the situation, the file of a literary work stored inthe flash memory card FMC(D) is once transferred to a personal computerPC. After that, the file of the literary work is transferred from thepersonal computer PC to another flash memory card FMC (E). In this case,the identifying information in the CIS field of the flash memory cardFMC(E) at the destination of the transfer is “DEF”, and it does notcoincide with the identifying information “ABC” in the transferred file.Therefore, the system apparatus SYS2 can note inconsistency between bothpieces of identical information and can judge it as an unapproved copy.

The identifying information in the CIS field may be a code assigned toeach literary work, or may be a code exclusive to each flash memory cardFMC or exclusive to a certain group. If a single byte is simply assignedas the area for storing identifying information, 256 kinds ofinformation from 00h to FFh can be set. When such identifyinginformation is written sequentially one by one in CIS fields of flashmemory cards FMC, different flash memory cards FMC have commonidentifying information with the probability of one per 256. However,the probability that an ordinary end user finds out another flash memorycard FMC having the same identifying information is very small. Byincreasing the number of bytes as the area for storing identifyinginformation, the probability of finding it out can be made sufficientlyclose to zero. Also when only one byte is assigned to the CIS field,code of the identifying information may be assigned for each album, forexample. Even if another flash memory card FMC having the sameidentifying information code is found, mutually copiable files are thesame files, and both are the literary work properly purchased.Therefore, there is no merit in making a copy.

It is sufficient for the identifying information in the file to berelated to the identifying information in the CIS field in a certainsense. For example, as shown in FIG. 9A, a cipher key may be made on thebasis of the identifying information stored in the CIS field so that thecipher file can be deciphered by using the cipher key.

Assume that the identifying information “ABC” is stored in the CIS fieldof a flash memory card FMC(F). A cipher key generator K1 in the systemapparatus SYS2 creates a cipher key from the identifying information“ABC”. The flash memory card FMC(F) stores a ciphered file which can bedeciphered with the cipher key created on the basis of the identifyinginformation “ABC”. A decipher means K2 in the system apparatus SYS2deciphers the cipher file stored in the flash memory card FMC(F) byusing the created cipher key. Thus, if the system apparatus SYS2 candecipher the cipher file, it can use the file. In contrast, if thesystem apparatus SYS2 cannot decipher the cipher file, it cannot use thefile. Judgement on success or failure to decipher the cipher file isexecuted by the judge means JD in the system apparatus SYS2.

The file stored in the flash memory card FMC may be totally or partlyciphered on the basis of the identifying information “ABC”.

That is, in the case where the file of the literary work is illicitlycopied, the cipher file cannot be deciphered, and the copyright of thefile stored in the flash memory card FMC can be protected in this manneras well.

When the cipher file is deciphered by using the identifying informationin the CIS field in this manner, it means that the identifyinginformation in the CIS field coincides with the identifying informationin the file. That is, consistency or inconsistency between theidentifying information in the CIS field and the information related tothe identifying information in the file may be expressed as the cipherfile being normally deciphered or not.

As explained above, by establishing a certain relation between the flashmemory card FMC itself and the literary work stored in the flash memorycard FMC, unapproved copy of the literary work can be prevented.

Third Embodiment

Next explained is the third embodiment of the memory system according tothe invention. Although the first and second embodiments take the caseswhere a flash memory card FMC is put on sale after storing a literarywork, the embodiment shown here takes a case where the information ofthe literary work itself is the subject to be sold, and the literarywork is purchased by down-loading it on a flash memory card FMC on sale.

For example, through a download-dedicated terminal DLT settled in a drugstore, station or any other convenient place, information of a literarywork is downloaded into the flash memory card FMC. The dedicateddownload terminal DLT is a terminal exclusive to download of literaryworks, which can freely refer to or rewrite the CIS field of a flashmemory card FMC. That is, it is sufficient that the result of writingthe file of the literary work on the flash memory card FMC through thededicated download terminal represents the status on sale of the flashmemory card FMC previously storing the literary work as explained in thefirst and second embodiments.

For example, as shown in FIG. 10A, prepared is a flash memory card FMCstoring “ABC” as the identifying information in the CIS field B beforedownload and storing “ABC” as the identifying information in the file ofthe literary work. By connecting the flash memory card FMC to thededicated download terminal DLT, data of a new literary work isdownloaded from the dedicated download terminal DLT onto the flashmemory card FMC. Since the identifying information in the file of theliterary work is “DEF”, the identifying information in the file in theflash memory card FMC also changed to “DEF. Additionally, during thedownload, the dedicated download terminal DLT writes the identifyinginformation “DEF” in the CIS field B of the flash memory card EMC.Therefore, in the flash memory card FMC, the identifying information inthe file of the newly downloaded literary work and the identifyinginformation in the CIS field B coincide. As a result, the end user canuse the flash memory card FMC in the system apparatus SYS2. Furthermore,the dedicated download terminal DLT may create the identifyinginformation by random numbers.

Simultaneously with rewriting the identifying information in the CISfield, the use of the literary work heretofore stored is disabled.However, as shown in FIG. 10B, if CIS has storage of some kinds ofidentifying information, the use of the original file already existingupon download need not be interrupted an can be continued even afterseveral occurrences of download.

For example, prepared is a flash memory card FMC storing “ABC” as theidentifying information in the CIS field B before download and storing“ABC” as the identifying information in the file of the literary work.By connecting the flash memory card FMC to the dedicated downloadterminal DLT, data of a new literary work is downloaded from thededicated download terminal DLT onto the flash memory card FMC. Sincethe identifying information in the file of the literary work is “DEF”,the identifying information in the file in the flash memory card FMCalso changed to “DEF. Upon this download, the file of the literary workheretofore stored is also maintained non-erased. Therefore, in the flashmemory card FMC, both the file of the literary work having theidentifying information “ABC” and the file of the literary work havingthe identifying information “DEF are stored. Additionally, upon the download, the down load dedicated terminal DLT write the identifyinginformation “DEF” in addition to the identifying information “ABC” inthe CIS field B of the flash memory card FMC. Therefore, both theidentifying information “ABC” and the identifying information “DEF” arestored in the CIS field B of the flash memory card FMC. As a result, inthe flash memory card FMC, both the file having the identifyinginformation “ABC” and the file having the identifying information “DEF”are enabled to use.

The dedicated download terminal DLT for downloading data is not limitedto the above-explained example. Vender machines of juice, for example,widely distributed in the society may be modified to include thefunction of the dedicated download terminal DLT, and they can be usedfor download. In this case, literary works for sale may be renewedsimultaneously with supplementation of commodities of the vender machineor in any appropriate intervals through wireless transmission like PHS,for example, or through wire transmission.

Public phones are also usable. By providing a public phone, or the like,with a connector for insertion of a flash memory card, a publictelephone line may be used to distribute literary works Similarsituation will be possible through PHS or portable phones, as well.Satellite broadcastings, CATV, etc. will be also usable for receivingdata. Even with personal computers, the same will be realized. A toolhaving the function of reading out data from the CIS field may be alsoprepared. By controlling a tool connectable to a USB port, serial port,printer port, ISA bus slot, etc. of a personal computer with specialsoftware, the personal computer will function similarly to the dedicateddownload terminal DLT to enable access to the CIS field for referringthe identifying information, for example, or for changing it.

The above explanation has been made on the adapter as using a generalpurpose adapter, such as PC card ATA interface, having a standard devicedriver for personal computers. However, it is also possible to use anadapter card not based on the PC card ATA interface but permitting auser to install a device driver and access to the CIS field, or othershaving similar functions, in combination with special download software.

The invention is applicable to various flash memory cards other thanthat shown in FIG. 1. For example, the invention can be employed also toa flash memory card FMC2 according to the PC card ATA interface as shownin FIG. 10C, for example.

The PC card ATA interface directly uses the protocol of hard discs ofIDE specification to a PC card type flash memory card FMC2. Typically,the flash memory card FMC2, which is an ATA card, includes therein acontroller or RAM R2 as a buffer, small-type flash memory FM3 forstoring firmware (with or without a controller), and so on, in additionto flash memory FM2 for storing data.

There are various methods usable to store information corresponding tothe identifying information of the CIS field in the PC card type flashmemory card FMC2. For example, an attribute memory space if defined inthe PC card, and a host system judges the type of the card (for example,ATA card, modem card, LAN card, etc. by referring to the attributememory space. The content in the attribute memory space is called tuple,and standardized by PC card standards, etc. In the standardizedspecification, there is an area permitting a card vender to fix venderinformation or product information. By using this area, operationspursuant to the intention of the above-explained embodiment are enabled.

In this case, the above-explained CIS identifying information may bestored on nonvolatile memory in the controller, or nonvolatile memorysuch as flash memory connected to the controller, or in main flashmemory for storing files in the card. Similar operations are possiblewith means other than the attribute memory space. In the ATA protocol,there is a command called Identify Drive (Hex Code ECh). This command isused to give notice on the specified values as the hard disc (forexample, numbers of sectors, cylinders and heads) to the host side. Inthe return value to this command, there is an area for storing the modelnumber, version number of the built-in microcode, and so on. This areamay be used to sore information corresponding to the identifyinginformation in the CIS field. As explained above, the place in the ATAcard for storing the value may be determined as desired. Alternatively,the value may be in a rewritable form taking account of its general useor in a form prohibiting erasure or rewrite for the purpose ofincreasing the security.

A new vender unique command may be used as well. By using a commandother than those determined by the ATA protocol, a value correspondingto the identifying information in the CIS field in the above-explainedembodiment may be output. For example, F3h may be determined as theidentifying information read-out command, or it is also acceptable torequest several times of command entry, such as F3h-F4h, for example.Regarding the way of output from the card, identifying information maybe output from the fist byte, or a certain value (such as AaH)indicating that this command is supported may be output, using the firstbyte or a predetermined number of bytes. It is also acceptable toprepare another command for judging whether the command is supported ornot.

The number of bytes of the identifying information may be determined asdesired. For the purpose of ensuring consistency with other commands, adesign configured to read out data of one sector (typically, 512 bytes).For example, a Read long command (22h/23h) transfers data including ECCbytes from the drive to the host after transferring the data of 512bytes. These bytes may include information corresponding to theidentifying code. Alternatively, it is possible to design so that datacorresponding to the identifying information be output when a certainsector is accessed, or the same information be obtained when a sectorother than the supported address space (number of sectors)is accessed.Alternatively, the controller itself may compare the identifyinginformation with the information concerning the identifying informationstored in the file to prohibit output of the file when they aredifferent. As explained above, it is sufficient for the entire system tohave the function of storing the memory card stores identifyinginformation by any appropriate means while storing information relatedto the identifying information in the file to enable their comparison.

Application of this embodiment is not limited to the ATA card. Usable asthe card are various memory cards having no controller, cards includinga controller of a type different from the ATA specification (it need notcontain CPU but may be made up of relatively simple SIC, etc.), cardsincluding memory other than flash memory (FRAM, SRAM, MROM, DRAM, etc.),and those combined with various types of memory. Also regarding theflash memory, the embodiment is not limited to the use of the NAND flashmemory used in the memory card shown in FIG. 1, may use any flash memoryregardless of its type, such as AND type, NOR type and DINOR type.Additionally, it is applicable to any nonvolatile memory other thanflash memory of byte-type EEPROM, serial EEPROM, EPROM, and so on. Alsofor recording mediums other than semiconductor mediums such as CD-ROM,DVD, MD, LD, HDD and FD, the same discussion is applicable. Only whenthe system includes a recording medium and a file stored in therecording medium, stores an exclusive identifying code in the recordingmedium and stores information having a certain relation with theidentifying code in the file, it satisfies the concept of the invention.

Furthermore, as already explained with reference to FIG. 9A, it issufficient for the identifying information in the file to be related tothe identifying information in the CIS field in any sense. For example,a cipher key may be made on the basis of the identifying informationstored in the CIS field so that the cipher file can be deciphered byusing the cipher key.

When the cipher file is deciphered by using the identifying informationin the CIS field in this manner, it means that the identifyinginformation in the CIS field coincides with the identifying informationin the file. That is, consistency or inconsistency between theidentifying information in the CIS field and the information related tothe identifying information in the file may be expressed as the cipherfile being normally deciphered or not.

As to the procedure for holding the identifying code, procedure forcomparing both pieces of information and treatment upon inconsistencybetween them, there is very wide freedom.

Fourth Embodiment

Next explained is the fourth embodiment of the memory system accordingto the invention. This embodiment intends further improvement of thereliability attained by the first to third embodiment. The embodimentshown here may be used in combination with any of the first to thirdembodiments, or may be used alone. This embodiment uses the setup of thestandard data storing specification (physical format) already explained,and it is characterized in intentionally creating a status partlydifferent from the status properly stored in the standard physicalformat.

For example, there is a method using the Data Status Area in theredundancy field RD explained with reference to FIG. 3. As explained,stored in the Data Status Area is the information indicating whether theinformation stored in the data field DT is normal or not therefore, thisData Status Area is normally set in “FFh”, but it is set in “00h” whenthe written data is found not normal. For example, in the case where auser tries to exchange data between a flash memory card FMC and apersonal computer by using an adapter card, if a sector with thedefective mark “00h” (indicating that the data is not normal) in theData Status Area of the flash memory card FMC is accessed from thepersonal computer, Error is returned back. Therefore, the user cannottransfer the file containing an area with the defective mark “00h” inthe Data Status Area by means of a personal computer, or the like. Usingthis nature, unapproved copy can be prevented.

A general aspect of this embodiment is shown in FIG. 11. A file A hasthe defective mark in a Data Status Area of the data in the file. Thatis, in a Data Status Area of at least one memory block among a pluralityof memory blocks forming the file A, the defective mark “00h” isattached. In contrast, the Data Status Area of the file B is normal.That is, here is assumed that all Data Status Areas of all memory blocksforming the file B are normal.

For example, taking a case of selling the flash memory card FMC afterstoring a literary work therein, the file A corresponds to it. In theprocess of storing the file of the literary work in the flash memorycard FMC, the defective mark is attached simultaneously in a Data StatusArea. Under the situation, in the case where a user tries to transferthe file of the literary work from the flash memory card FMC onto apersonal computer by using a general purpose adapter card, for example,if the memory block field storing the file A is accessed, the controllerin the adapter card judges the data stored in the corresponding memoryblock to be not normal, ad returns Error to the host. In this case, forexample, a message “an error found in the drive”, or the like, isdisplayed on the screen of the personal computer, and the transfer ofthe file is interrupted. In contrast, Data of a file B with no defectivemark in any Data Status Area can be freely transferred to the personalcomputer.

In this manner, by storing the file of the literary work in the flashmemory card FMC while intentionally assigning the defective markindicating that the data is not normal, unapproved file copy of theliterary work can be prevented. Needless to say, however, the systemapparatus (music player, for example) has to understand that the mark inthe Data Status Area has been attached intentionally, and to regard asthe proper data being stored. Therefore, when intentionally attachingthe defective mark in a Data Status Area, the area for attaching thedefective mark should be determined previously.

Regarding the positions for assigning the mark, various ways will beemployable. For example, assume here that the mark attached to eachfile. It is also possible to attach the defective mark in all sectors inthe entire file (all memory blocks). Alternatively, the defective markmay be attached to some of the sectors (some memory blocks). Forexample, it is possible to employ the transaction of previouslydetermining which numbered sector (memory block) in the file should beused for the purpose.

Alternatively, a particular sector (memory block) for attaching thedefective mark may be determined previously. For example, by determiningall of the data in the first sectors (memory blocks) as FFh, and thedefective mark may be attached to the first sectors.

Positions for attaching the defective mark are not limited to those inthe file. For example, a DOS file management field may be used. Also,the mark may be attached in a master boot sector field, partition bootsector, FAT field, root directory field, subdirectory field, and soforth. If the mark is attached in the master boot sector field, etc, thepersonal computer cannot identify it as the drive, transfer of the fileis disabled.

The mark in the Data Status Area is effective for read operation. Ifanother instruction for writing the same area is issued, new data iswritten, and the mark in the Data Status Area disappears. Therefore,also in a card having a copy preventing mechanism according to theinvention for the purpose of reproduction of music, if the correspondingfile becomes useless, another file may be written, or the card may bere-used in another system.

The embodiment shown here is applicable in various modified forms withinthe concept of preventing unapproved copy by intentionally creating astatus partly different from the original proper status and having thestatus judged by a general purpose system. In other words, depending onthe contents of the management information additionally stored in thebody of the data, the system approves or prohibits data readingoperation. Although an ATA adapter card is so configured that itsbuilt-in controller returns Error, when an adapter card, or the like,having no built-in controller is used, the device driver on the personalcomputer executes this judgement. Also regarding the way of returningError, there are various methods. In case of an ATA adapter, occurrenceof a non-correctable read-out error may be noticed to the host, or thenotice of entry of an unapproved command may be given (command abort),or an error code indicating that the designated sector has not beenfound may be returned. Any desired way of returning Error may beemployed.

Next shown is the way of using the Block Status Area. As set forth, eachBlock Status Area demonstrates good or bad status of the block. Althoughit is normally “FFh”, in case of a defective block, “00h” (initiallydefective block) or “F0h” (afterward defective block) is set. If two ormore bits exhibit “0”, then the memory block are judged defective.

As explained before, the system apparatus is typically configured tosearch Block Address Areas-1 and/or Block Address Areas-2 in allphysical blocks Block 0 through Block 511 immediately after the supplyof power, and makes a conversion table of logical blocks and physicalblocks as shown in FIG. 4 on a system RAM. Once the conversion table ismade, location of a physical block corresponding to a certain logicalblock can be readily known with reference to the conversion table.Therefore, it is sufficient to conduct the search of all memory blocksonly once subsequently to power-ON.

Needless to say, if there occurs any change in location of a physicalblock due to data renewal thereof, then the conversion table must berenewed to be available for a next access.

Upon making the conversion table shown in FIG. 4, all memory blocksBlock through Block 511 are searched, and in this search process, thesystem apparatus first makes reference to the Block Status Area. If adefective mark is attached to the Block Status Area, the systemapparatus judges the memory block as being an electrically defectiveblock and having symptoms disabling erasure or writing, or generatinguncorrectable errors. Therefore, the system apparatus interrupts theprocess of reading Block Address Areas-1, -2, etc. of this memory blockand incorporating them into the conversion table, and proceeds to theprocess of the next memory block. Therefore, the defective block isnever accessed by the system apparatus until the next power-ON. As aresult, data in the defective block with the defective mark in the BlockStatus Area cannot be referred to with a general purpose systemapparatus.

Explained below a method for protecting a literary work by using thismechanism. This method attaches a defective mark to the Block StatusArea in the memory block, and uses this defective mark for copyrightprotection. For example, as explained in the first to third embodiments,identifying information in the flash memory card FMC, for example, isstored in an apparent defective block. Its general aspect is shown inFIG. 12.

As shown in FIG. 12, a system apparatus (for example, music player) SYS3expects consistency of the identifying information stored in thedefective block and identifying information buried in the file. In caseof the flash memory card FMC (A), identifying information in thedefective block is “ABC”, identifying information buried in the file isalso “ABC”, and both coincides. Therefore, the system apparatus SYS3 canjudge the literary work stored in the flash memory card FMC(A) as beingthe original literary work. In contrast, in case of the flash memorycard FMC(B) and the flash memory card FMC(C), a difference is foundbetween the identifying information in the defective block and theidentifying information buried in the file. Therefore, the systemapparatus SYS3 judges the stored literary work as being illicitlyacquired, and adds restriction to the process. In this manner, bycomparing and reviewing the identifying information in the defectiveblock and the information related to the identifying information buriedin the file, the original literary work can be distinguished. Thisjudgement is executed by the judge means JD in the system apparatusSYS3.

Flash memory cards FMC may have inborn or acquired defective blocks.There are various methods for identifying defective blocks storingidentifying information. For this purpose, it is sufficient that anydata for confirming existence of identifying information in thecorresponding block, for example. For instance, data “AAh-55h” ispreviously written in the initial bytes of the leading page of theblock, for example. Alternatively, a plurality of pieces of identifyinginformation (one sector or more sectors) may be written, or theidentifying information may be stored together with a result ofcalculation made by using it (for example, parities or checksum). It issufficient to provide a procedure minimizing the probability that dataoccasionally existing in an intrinsic defective block happens tocoincide with the method for storing the identifying information. If arule is determined to use from a block nearer to the leader or the endof a chip, for example, a target block will be found earlier.Information to be stored in an apparent defective block is not limitedto the above-mentioned identifying information. For example, in casethat the system is a music player, it may be designed to includeinformation related to the file name approved to listen to with thismedia and to prohibit reproduction of the other pieces of music. Theessential matter of the present invention lies in intentionally makingan area never accessed by general purpose systems and having means forconfirming originality of the literary work with reference to datastored in the area.

The above explanation has been made as using the Data Status Area andthe Block Status Area. However, the same transaction is possible even inthe other areas shown in FIG. 3. It is possible to use a four-byte areacurrently reserved for a future use under the same concept or tosimilarly use the Block Status Area. In the Block Status Area, twoidentical matters are stored in each sector, and in case of a 16-Mbit(2-megabyte) product, 16 Block Status Areas exist in each block. Atypical system apparatus refers only to the Block Address Area in theinitial or final sector of each block. Therefore, Block Address Areas inintermediate sectors in each block may be used for the same purpose asexplained heretofore. The use of the Reserved Area and the Block AddressArea is also from the same concept as the method of using the BlockStatus Area and the Data Status Area from the viewpoint that it ischaracterized in intentionally making a status partly different from thenormally stored status under a standard physical format.

Among areas shown in FIG. 3, areas including “ECC” in their names havenot been explained yet. Needless to say, these areas can be used for thesame purpose as that of the above-explained examples, but can be alsoused from another point of view.

In the flash memory card shown in FIG. 1, ECC (error correction code) isused. Details of the ECC system is not explained here because they arenot directly relevant to the concept of the invention, but here is usedECC capable of detecting 2-bit errors and correcting 1-bit errors foreach sector (precisely, for every 256 bytes divided into two from 1sector).

Similarly to the discussion made heretofore, here is taken a case wherethe flash memory card is sold after storing literary works or data isacquired by download from a dedicated download terminal.

For example, in a status including an intentionally generated ECC error,a literary work is stored in the f lash memory card FMC. A generalaspect of this case if explained with reference to FIG. 13. Forsimplicity, assume that the status with an ECC error is intentionallyproduced in the area for storing the file name.

Assume, for example, that the file name stored in the original flashmemory card FMC(A) is “ABC”. In this case, actual data in the flashmemory card FMC(A) is stores as 41h, 42h and 43h. Then, by adjusting thecode of ECC in the f lash memory card FMC(A), the status as if includingan error in the area storing the file name “ABC” is created.Furthermore, for example, the area storing the file name is adjusted toexhibit “ACC” (41, 43h, 43h) when corrected by the ECC code.

Assume here that the controller, etc. in the system apparatus (musicplayer, for example) already locates the position with intentionallycreated ECC error. Therefore, the system apparatus considers only thefile written with 41h, 42, 43h 43h to be the original literary work.That is, the flash memory card FMC(A) from which “ABC” is read out asthe file name is admitted to store the original literary work.

Here, it is possible to transfer the file of the literary work with thefile name “ABC” stored in the flash memory card FMC(A) onto the personalcomputer PC via an adapter card, for example, and also to another flashmemory card FMC (B).

In this case, when the file is transferred from the original flashmemory card FMC (A) to the personal computer PC, the intentionallycreated error is automatically corrected by the controller in theadapter card. That is, in this example, the file name changes from “ABC”to “ACC”. Therefore, the file name finally transferred to another flashmemory card FMC (B) becomes “ACC”. When the flash memory card FMC(B) isinserted into the system apparatus SYS4, since the file name is not theexpected file name “ABC”, the controller in the system apparatus SYS4can find the file as an unapproved copy.

Judgement of the file name being “ABC” or “ACC is executed by the judgemeans JD in the system apparatus SYS4.

For simplicity, here is taken the file name as an example. However,since the file name can be readily rewritten by an end user through apersonal computer, another area is desirable to use for actualapplication of the invention if the location with the intentionallycreated error is previously determined, it is acceptable alternatively,the location for intentionally creating the error is not limited to asingle position, but a plurality of positions may be used for thispurpose. Location to be marked may be inside the file as well. Forexample, it may be the DOS file management area, for example. If thefile transferred to the personal computer via a general purpose adapter,for example, is copied with any difference from the original file in thestart device, the purpose is satisfied.

Although the above example has been explained as intentionally producinga correctable 1-bit error, it may be modified to intentionally generatea correctable error of two or more bits. In this case, if it isattempted to transfer the file to the personal computer by using ageneral purpose adapter card, etc., the controller in the adapter carddetects the non-correctable error, and inform the personal computer ofoccurrence of the error. Thus, the transfer of the file is interrupted.It results in preventing the file from being copied from the originalmemory card. Needless to say, location for intentionally generating the2-bit error as explained above may be chosen as desired. When an errorof 3 bits or more is intentionally generated, there arises thepossibility that the error is not detected or erroneously corrected.This mechanism may be used.

Fifth Embodiment

Next explained is the fifth embodiment of the memory system according tothe invention. In the first to fourth embodiments, consideration hasbeen made, assuming that the flash memory card FMC is stored afterstoring literary works. In this example, however, it is assumed that thefile is acquired by download from the Internet through a personalcomputer, and the use of existing hardware is essential. Assume ageneral purpose adapter card, for example. In the case where a file isdownloaded onto the hard disc of the personal computer from the Internetand thereafter transferred to the flash memory card FMC via the generalpurpose adapter, it may occur that the mechanism of copyright protectionusing the hierarchy of the physical format as employed in the first tofourth embodiments cannot be used. This is because, when the file istransferred to the flash memory card FMC from the personal computer, forexample, via the adapter card, the personal computer cannot refer to theCIS field in the flash memory card FMC. Therefore, the operation foracquiring identifying information into the file from the CIS field isdisabled.

A general aspect of the mechanism for copyright protection in thisdownload system is shown in FIG. 14. The system apparatuses (forexample, musical players) SYS5 and SYS6 are assigned with theirinformation of their own (simply referred to as apparatus number forsimplicity in the explanation made below). In the example of FIG. 14,the system apparatus SYS5 is assigned with apparatus number 100 whereasthe system apparatus SYS6 is assigned with apparatus number 200.

The apparatus number is preferably identifiable absolutely one by one.However, it is acceptable to decrease the possibility what two systemapparatuses have a common apparatus number. And, both serial numbers andrandom numbers are acceptable, and they may be incorporated into maker'sproduction numbers, for example. There are various ways for assigningapparatus numbers. A method attaching metal plates onto outer shells ofsystem apparatuses or onto their interior portions (for example,portions for loading batteries). Alternatively, they may be displayed ondisplays of the system apparatuses, guided by voices, or written ontheir manuals or guarantee documents. That is, it is sufficient toprovide any mechanism enabling end users to get aware of the apparatusnumbers of their system apparatuses.

The apparatus numbers are also stored in identifying information storagemeans IIM of the system apparatuses SYS5 and SYS6, and the controllersinside the system apparatuses can freely refer to these identifyinginformation storage means IIM for example, they may be stored onnonvolatile memory inside the controllers, or other nonvolatile memoryconnected to the controllers via buses. If their backup is held bybatteries, then they may be stored on memory such as SRAM, DRAM, etc.Alternatively, they may be stored by mechanical means such as dipswitches, etc. It is sufficient for any means corresponding to acontroller to refer to through electrical means.

A download method from Internet is explained below using a specificexample. As shown in FIG. 14, a web site (WEB) distributing musicalpieces forms a distribution center DISC. An end user selects a piece ofmusic he desired to download from the distribution center DISC byoperating a personal computer PC, and enters the apparatus number of hisown system apparatus (music player). In this example, the apparatusnumber 100 is entered. After that, the selected piece of music isdownloaded onto the hard disc, for example, in his personal computer PCfrom the distribution center DISC. Upon this download, the apparatusnumber, or some information closely related to the apparatus number, isalso acquired into the file. Needless to say, the service isappropriately charged to the end user by entry of his credit cardnumber, for example.

In the example of FIG. 14, the file with the information related to theapparatus number 100 of the system apparatus SYS5 of the end user's ownresults in remaining on the hard disc. The end user transfers the filefor the apparatus number 100 to the flash memory card FMC(A) by usingthe general purpose adapter card, for example.

When the flash memory card FMC(A) is inserted into the system apparatus,the system apparatus refers to the storage area of the informationrelated to the apparatus number in the file. If coincidence is confirmedbetween the apparatus number of the system apparatus and the informationrelated to the apparatus number in the file, the system apparatusconsiders the file number to be the original file and approvesreproduction of the piece of music. If coincidence is not confirmed, itconsiders it to be an illicitly acquired file, and prohibitsreproduction of the piece of music. This judgement is executed in thejudge means JD in the system apparatuses SYS5 and SYS6.

In the example of FIG. 14, the file stored in the flash memory cardFMC(A) is the file for the apparatus number 100. Therefore, when theflash memory card FMC(A) is inserted into the system apparatus SYS5, thefile can be used. However, if the flash memory card FMC(A) is insertedinto the system apparatus SYS6 having the apparatus number 200, thisfile cannot be used.

Therefore, according to the embodiment shown here, a file obtainedthrough the Internet can be used solely in a specific system apparatus.When the above-mentioned flash memory card is inserted in another systemapparatus, it cannot be used because its apparatus number does not meetthe information in the file. Therefore, distribution of data results inbeing executed toward a specific system apparatus and not to a specificflash memory card FMC.

Assume here that the file remaining on the hard disc of the personalcomputer PC to another flash memory card FMC. In this case, the file onthe hard disc can be copied in its complete form to other flash memorycards FMC endlessly. However, in the file copied and transferred to theflash memory card FMC, the apparatus number 100 of the original systemis introduced to indicate the system in which the file should operate.Therefore, although the file can be copied to flash memory cards FMCwithout limitation, the use of the flash memory cards FMC is limited toa specific system apparatus. Therefore, this method is also useful toprotect copyrights.

In the above-explained embodiment, a certain file can be used solely ina specific system apparatus. However, it may be modified to permit it tobe used in a plurality of system apparatuses. Upon the download from theInternet, the above embodiment permits only one apparatus number to beentered. However, at least two apparatus numbers may be allowed toenter. This is useful, considering that a single person may have aplurality of apparatuses.

It is also possible to provide a means, such as management flag,enabling storage of not only apparatus numbers of usable systemapparatuses but also apparatus numbers of those prohibited to use. Forexample, in the case where two system apparatuses are previouslyregistered, but one of them thereafter abandons the right to use thefile, procedures to cancel the registration of the system apparatus isenabled.

As means for increasing the number of system apparatuses to beregistered as usable ones, a file increasing the number of registeredsystem apparatuses may be transferred from the Internet, or softwareenabling additional registration of system apparatuses may be solelytransferred from the Internet. That is, in a system in which, under thepresence of an apparatus number exclusively assigned to a systemapparatus and a file to be acquired in a form including informationrelated to the apparatus number, the system apparatus is configured toconfirm coincidence of both data to approve or prohibit operations, ifthe system includes any means permitting changes in number of registeredapparatuses, such as addition or cancellation of apparatus numbers, forexample, the purpose of the invention is attained.

The above-explained embodiment copes with any change in number of systemapparatuses using the file by renewal of system apparatus numbers storedin the file. However, it may be modified to change the apparatus numberon the part of the system apparatus. Taking the example of FIG. 14,assume that the end user owns the system apparatus SYS5 having theapparatus number 100 and the system apparatus SYS6 having the apparatusnumber 200, and he has a number of files obtained by a certain method(for example, from the Internet) to use them in the system apparatusSYS5 with the apparatus number 100. If the end user want to use thesefile in the system apparatus SYS6 with the apparatus number 200, a lotof tasks may be required, depending on the number of the files, if it isdealt with by renewal of the apparatus number in these files asexplained in the above embodiment.

Such situation can be improved by providing a means capable of changingthe apparatus number 200 of the system apparatus SYS6 to the apparatusnumber 100. That is, when the apparatus numbers of two systemapparatuses SYS5 and SYS6 is unified to 100, the files can be commonlyused in two system apparatuses.

Various methods are usable as means for changing apparatus numbers ofsystem apparatuses. For example, it may b e realized by operationthrough input keys of a system apparatus. Alternatively, it is alsoacceptable to distribute software for changing apparatus numbers fromthe Internet, then transfer it onto a flash memory card FMC, and executethe software on the system apparatus.

On the other hand, since it is undesirable to permit changes ofapparatus numbers without limitation, the software for changingapparatus numbers may be distributed, specifying the original number andthe new number of the system apparatus to be changed. It is alsopossible to not only simply permit changes of apparatus numbers but alsopermit a single system apparatus to have a plurality of apparatusnumbers. For example, in the example of FIG. 14, if the system apparatusSYS5 having the apparatus number 100 is authorized to have the apparatusnumber 200 as well, it will use the files heretofore usable solely inthe system apparatus SYS6 having the apparatus number 200 in addition tothe files heretofore usable in the system apparatus numbered 100.

In this manner, the subject matter of the embodiment shown here lies inenabling renewal of apparatus number information, etc. exclusive to asystem apparatus together by changing it, adding another or deleting it,for example. Further, it is another feature of the embodiment that asingle system apparatus may have a plurality of apparatus numbersinstead of being fixed to only one apparatus number. Change of theapparatus number may be done in the manufacturing process of the systemapparatus or on the market for sale. For example, a new system apparatusis to be purchased to replace a malfunctioning system apparatusheretofore owned, it is useful to provide a system with which a user maysend the old system apparatus to the manufacturer or seller side andpurchase a new system apparatus having the same apparatus number. Alsowhen a new system apparatus is additionally purchased, the system mayprovide a means for evidencing that the old system is currently owned,and enable the user to purchase the new system apparatus with the sameapparatus number as that of the old system apparatus.

Furthermore, as already explained with reference to FIG. 9A, it issufficient for the apparatus number in the file to be related to theapparatus number in the CIS field in any sense. For example, a cipherkey may be made on the basis of the apparatus number stored in the CISfield so that the cipher file can be deciphered by using the cipher key.

When the cipher file is deciphered by using the apparatus number in theCIS field in this manner, it means that the apparatus number in the CISfield coincides with the apparatus number in the file. That is,consistency or inconsistency between the apparatus number in the CISfield and the information related to the apparatus number in the filemay be expressed as the cipher file being normally deciphered or not.

Sixth Embodiment

Next explained is the sixth embodiment of the memory system according tothe invention. The first to fifth embodiments are configured toindividually distinguish flash memory cards FMC and system apparatuses.This embodiment, however, is configured to distinguish individual users.

For simplicity, taking birth days of individuals as an example forexplanation. Personal identifying information for identifyingindividuals is not limited to birth days. It may be any of names,arbitrarily selected passwords, credit card numbers, social securitynumbers, and so forth, and information need not be different by 100%among different individuals. It is sufficient for information of anindividual to be different from those of other individuals with acertain probability. Here is taken a case where an end user havingpurchased a system apparatus (here is taken a music player as anexample) buys a musical file from the Internet.

As shown in FIG. 14A, the identifying information storage means IIM ofthe system apparatus SYS7 has the personal identifying informationtherein. If the birth day of the end user is Dec. 31, 1980, the personalidentifying information is “19801231”. The personal identifyinginformation may be acquired in any desired way. When the end user buysthe system apparatus in a shop, the seller may set it, or the end usermay set it after the purchase.

When the end user purchases a file from the Internet, he gives hisdesignated personal identifying information. That is, the end usertransmits his personal identifying information “19801231” from hispersonal computer PC to the distribution center DISC on the Internet.The distribution center DISC transmits information concerning a musicalliterary work adding the personal identifying information “19801231” orother information related to it to the personal computer PC. As aresult, a file for the individual is downloaded in the hard disc of thepersonal computer PC.

The end user transfers the file on the hard disc to the flash memorycard FMC(A). As a result, a personal file for music including thepersonal identifying information “19801231” is stored in the flashmemory card FMC(A).

If the flash memory card FMC (A) is inserted into the system apparatusSYS7, the system apparatus SYS7 compares the personal identifyinginformation “19801231” held on the system apparatus SYS7 with thepersonal identifying information introduced into file, and only uponconfirmation their consistency, reproduction of the music in the file isapproved. This judgement is executed by the judge means JD in the systemapparatus SYS7.

A feature of the embodiment lies in that, by acquiring personalidentifying information into files, an end user having a plurality ofsystem apparatuses, for example, can commonly use a single file in allhis apparatuses. In the example of FIG. 14A, the flash memory cardFMC(A) storing a file for the personal identifying information“19801231? can be used commonly in both the system apparatus SYS7 andthe system apparatus SYS8.

The embodiment shown here is very convenient, when considering the casewhere the end user purchases an additional system apparatus, or one ofsome apparatuses of his own malfunctions. The same also applies to thecase where personal names are used instead of birth days. Files can befreely copied from a hard disc to a plurality of flash memory cards FMC.However, their reproduction is not possible in system apparatuses otherthan those of the individual who purchased the files. If anotherindividual has the identical birth day or name, he can use them, but itsprobability is very low. Needless to say, the probability is actuallyreduced to zero if different kinds of personal identifying informationare combined (birthday and name), and the copyright can be protectedmore reliably. Personal identifying information on an apparatus and thatin a file are preferably allowed to be added, changed and deleted. Thus,an individual changed in name by marriage, for example, can continue tobe use them, or an assignee of the right can use them subsequently.

Furthermore, as already explained with reference to FIG. 9A, it issufficient for the personal identifying information in the file to berelated to the personal identifying information in the CIS field in anysense. For example, a cipher key may be made on the basis of thepersonal identifying information stored in the CIS field so that thecipher file can be deciphered by using the cipher key.

When the cipher file is deciphered by using the personal identifyinginformation in the CIS field in this manner, it means that the personalidentifying information in the CIS field coincides with the personalidentifying information in the file. That is, consistency orinconsistency between the personal identifying information in the CISfield and the information related to the personal identifyinginformation in the file may be expressed as the cipher file beingnormally deciphered or not.

Seventh Embodiment

Next explained is the seventh embodiment of the memory system accordingto the invention as a method for further increasing the security. Theforegoing embodiments are directed to methods for copyright protection,taking ordinary end users as the target. The embodiment shown here,however, is in the standpoint of preventing a mala fide third party fromexecuting malpractice.

For example, electric interface specifications of flash memory cards FMCare opened to public via information on the Internet, for example.Therefore, it is not technically impossible to create a special tool formaking a faithful dead copy of data in a certain flash memory card ontoanother flash memory card FMC in the unit of byte as an assembly ofbinary data instead of copying data in the flash memory card FMC in theunit of file. In this case, a flash memory card FMC having absolutelythe same series of data as that of an original flash memory card can bemade, and it is difficult for the system apparatus to distinguish them.This embodiment has been made in view of this problem, and proposes acountermeasure against such dead-copy operations.

The subject matter of this embodiment lies in putting identifyinginformation for identifying individual flash memory cards FMC in aspecial field impossible to access with publicly opened information, ora special field impossible to freely rewrite data therein even ifaccessed, in the field of each flash memory card FMC, and also puttingsimilar identifying information in files or introducing informationrelated to such identifying information, and having a system apparatusconfirm consistency or inconsistency between them.

With reference to FIG. 14B, an example is explained. Identifyinginformation “ABC” is stored in a special field impossible for the enduser of the flash memory card FMC(A) to access or to rewrite data freelytherein. In a file stored in an ordinary field of the flash memory cardFMC (A), “ABC” is stored as identifying information of the file. Thesystem apparatus SYS9 to which the flash memory card FMC(A) is insertedreads the identifying information “ABC” in the special field and theidentifying information “ABC” in the file. Since they coincide, thesystem apparatus SYS9 approves the use of the file.

In contrast, in a special field impossible for the end user of the flashmemory card FMC(B) to access or impossible to rewrite data freelytherein, identifying information “ABC” is stored. In a file stored in anordinary field of the flash memory card FMC(B), “DEF” is stored asidentifying information of the file. The system apparatus SYS9 to whichthe flash memory card FMC(A) is inserted reads the identifyinginformation “ABC” in the special field and the identifying information“DEF” in the file. Since they do not coincide, the system apparatus SYS9does not approve the use of the file.

Judgement of consistency or inconsistency between the identifyinginformation stored in the special field of he flash memory card FMC andthe identifying information in the file is executed by the judge meansJD in the system apparatus SYS9.

Next explained is an example of the special field in the flash memorycard FMC, which is impossible for an end user to access or impossible tofreely rewrite data therein. For example, nonvolatile semiconductormemory devices involving the flash memory card FMC shown in FIG. 1 havean operation mode usually called ID read this mode is the mode forexternally notifying the manufacturer, type, capacity, electricalspecification, etc. of the memory. In the flash memory card FMC shown inFIG. 1, for example, ID read is executed in the process shown in FIG.15.

As shown in FIG. 15, an ID read command (90h here) and an address (00hhere) are entered into the flash memory card FMC. Then, a codeindicating its manufacturer (maker code) and a device code indicatingthe type of the memory are output sequentially from the flash memorycard FMC.

In case of a 64-Mbit flash memory card manufactured by Toshiba, forexample, “JEDIC ID 98h” is output as the first byte, and the device codeE6h indicating the product being NAND flash memory of 64 megabits forthe operation power 3.3V is output as the second byte. If the memory isone for 64 megabits but mask ROM instead flash memory, D6h is output asthe device code. The system apparatus reads these pieces of informationand performs control appropriate for the device specification.

In the present invention, this ID read operation is extended. That is,as shown in FIG. 16, identifying information exclusively assigned to theflash memory card FMC is output subsequently to outputs necessary forthe conventional ID read operation. It may be freely selected from whichbyte the output of the identifying information starts and to which byteit continues.

In order to reliably distinguish flash memory card products supportingthis function from conventional flash memory card products, any materialindicating that the product has such support may be output (data such asAAh having a slight probability of occasional existence of the same dataon the bus) prior to the output of identifying information.

As already explained, the identifying information need not be unique toeach of all flash memory cards FMC (needless to say, preferably unique).For example, if the identifying information is made up of one byte,there are 256 possible values from 00h to FFh. Therefore, flash memorycards can be classified into 256 groups. In this case as well, theprobability that two different end users have flash memory cards FMChaving common identifying information is considered sufficiently low.

In the embodiment explained above, the existing ID read command isutilized. However, a new identifying information read command may bedetermined independently. This provides higher security than the use ofthe ID read command the method to access to which is disclosed. Ageneral aspect of this scheme is shown in FIG. 17. Here is shown thecase where the command of one cycle is set as the identifyinginformation read command. However, it may be modified to request entryof the command of a plurality of cycles.

There are various ways of determining the identifying information. Firstshown is a method which determines it in the manufacturing process ofthe flash memory card FMC. The preset value may be determined tosubstantially fully identifying all cards one by one such as throughnumbers, or by generating random numbers. Additionally, it may bedetermined for each wafer or each chip. If the value is determined toensure a memory card to have different identifying information fromother memory cards with a certain probability, any mode of determinationof such values fully meets the subject matter of the invention. It maybe determined by a maker of a literary work who sells the flash memorycard FMC with storage of the literary work, for example, instead of themanufacturer of the flash memory card FMC itself.

Additionally, there are various modes of writing identifyinginformation. First shown is a method which writes it in the process ofthe flash memory card FMC. As shown in FIG. 18, for example, there isthe method using a fuse FS. FIG. 18 is a diagram showing an arrangementof a state holding circuit.

In the state holding circuit, there is a difference in value held uponpower-ON between the state with the fuse FS cut and the statemaintaining it uncut. By preparing at least one state holding circuit,it is determined to cut the fuse FS or not, depending upon the presetidentifying information. For example, when an identifying informationread command is entered, the value held in the state holding circuit isexternally output through an output buffer.

There are various means usable as the fuse FS, such as those burned andcut by a laser, electric wiring thermally cut by supplying a current,those made up of nonvolatile memory like EEPROM and functioningsimilarly to electric fuses, and so on. It is also possible to provide achip as a bonding option in the assembling process. By preparing a padfor connecting a metal wire on a chip, the holding value may be changed,depending upon whether the pad is electrically connected to VCC or GRD.

Alternatively, the change of the holding value may be attained byselectively using masks of a wiring layer used in the manufacturingprocess. For example, if different kinds of masks are selectively usedin a process close to the final manufacturing process for making analuminum wiring layer, a certain variety of identifying information canbe set.

Alternatively, the purpose is attained by setting mechanically to acertain extent to bury a small-type dip switch. It is also possible toprovide another nonvolatile memory holding identifying information inaddition to the flash memory card so that the value of the identifyinginformation be obtained by the additional nonvolatile memory. That is,some IC or part to be used for protecting the copyright may be mountedinside the flash memory card simultaneously with the flash memory. Thepurpose is attained only if individual identifying information in eachmemory card by some means in the manufacturing process.

The identifying information may be set to permit rewrite thereof laterby cutting the electrical fuse, for example, or may be configured topermit rewrite thereof later by using EEPROM, for example instead of afuse. In the case permitting rewrite thereof, by providing a meansdisabling rewrite thereof after a certain point of time, such as a modedisabling rewrite thereof after the electric fuse is cut, for example, awider compatibility is ensured.

Furthermore, as already explained with reference to FIG. 9A, it issufficient for the identifying information in the file to be related tothe identifying information in a special field in any sense. Forexample, a cipher key may be made on the basis of the identifyinginformation stored in the special field of the flash memory card FMC sothat the cipher file can be deciphered by using the cipher key.

When the cipher file is deciphered by using the identifying informationin the special field in this manner, it means that the identifyinginformation in the special field coincides with the identifyinginformation in the file. That is, consistency or inconsistency betweenthe identifying information in the special field and the informationrelated to the identifying information in the file may be expressed asthe cipher file being normally deciphered or not.

Eighth Embodiment

As an embodiment derived from the seventh embodiment, the eightembodiment of the memory system according to the invention is explainedbelow. Unlike the seventh embodiment, the subject matter of the eighthembodiment lies in preparing a memory space in the flash memoryseparately from the field used by the user, and storing individualidentical information of the flash memory card in the memory space.

In case of 64-Mbit memory, for example, the memory space of 64 megabitsis reserved for use by the user. However, by providing another memoryspace in addition to the 64-Mbit memory space, and identifyinginformation is held therein. Needless to say, the redundant memory spacecan be accessed to by a method different from the method for accessingto the ordinary memory space of 64 megabits.

FIG. 19 shows a general aspect of physical memory blocks of the flashmemory card FMC. In case of 64-megabit flash memory, for example, thememory cell array is divided into 1024 memory blocks (unit of erasure)Block 0 through Block 1023 each of 64 kilobits. In addition to these1024 blocks, eight redundancy blocks RDBlock 0 through RDBlock 7, forexample, are prepared. These redundancy blocks RDBlock 0 through RDBlock7 may be prepared by commonly using blocks prepared for exchange ofblocks when any defective block is found in the manufacturing process asalready known, or may be prepared separately.

A special command for accessing to these redundancy blocks RDBlock 0through RDBlock 7 (hereinafter called redundancy block access command)is prepared. In these redundancy blocks RDBlock 0 through RDBlock 7,identifying information for identifying individual flash memory cardsFMC is written. As explained in the embodiment 7, there is room for freechoice regarding which stage is selected for writing the identifyinginformation.

For example, let a case be taken where identifying information iswritten in any of the redundancy blocks RDBlock 0 through RDBlock 7 inthe manufacturing process, and the flash memory card FMC is sold afterstoring a literary work. When the literary work is written into theflash memory card FM, a write tool read out the identifying informationfrom the redundancy block RDBlock by the redundancy block accesscommand.

After that, the read-out identifying information or information relatedto the identifying information is taken into the file of the literarywork, and written as a file in the flash memory card FMC. The systemapparatus compares the identifying information of the flash memory cardFMC written in the redundancy block RDBlock with the identifyinginformation taken into the file, and approves the use on the systemapparatus when predetermined conditions are satisfied.

Under the situation where the file is transferred from a certain flashmemory card FMC to another flash memory card FMC, if a user tries toactivate it on another system apparatus, since the identifyinginformation written in the redundancy block RDBlock of the flash memorycard FMC as the destination of the copy file does not coincide with theidentifying information of the flash memory card FMC taken into thecopied file, it cannot be used. Thus, the copyright of the literary workcan be protected.

There are various modes of identifying information of the flash memorycard FMC written into the redundancy blocks RDBlock 0 through RDBlock 7as already explained in the foregoing embodiments. The identifyinginformation of the flash memory card FMC may be simply stored, or aplurality of pieces thereof may be stored so that they are compared whenactually used. Alternatively, additional information may be attached foruse to judge adequacy of the identifying information. For example, it ispossible to store it together with a result of calculation of parities,or to store it together with a code for error correction to enable errorcorrection when any error occurs. Alternatively, the identifyinginformation may be stored together with its complement (for example,complement 55h in case of identifying information AAh).

Moreover, it is also acceptable to enable direct application of the ECCsystem used for storing an actual file in the flash memory card FMCshown in FIG. 1. If one block is made up of 16 pages for example, in theflash memory card FMC shown in FIG. 1, then the identifying informationmay be stored in a plurality of pages, or it may be stored in aplurality of blocks.

Furthermore, the identifying information may be stored together withinformation for confirming storage of identifying information in theredundancy block RDBlock (for example, a row of one or morepredetermined letters) and/or management data such as flags whichindicate whether the corresponding redundancy blocks RDBlock areelectrically normal or include a defective block. For example, iftwo-block space is prepared as the field for storing the identifyinginformation (priority may be provided), even if one of them isdefective, the production yield is not reduced. In this case, the systemapparatus judges from the state of management flag whether they arenormal redundancy blocks RDBlock, and thereafter, while judging from thepresence of absence of the predetermined row of letters whether theidentifying information is stored or not, it acquires the identifyinginformation. If the first accessed redundancy block RDBlock isdefective, the next redundancy block RDBlock is accessed of course.Although there are other various methods, as set forth in the seventhembodiment, only if unique identifying information of an individualflash memory card FMC is stored in a field difficult for a user toaccess, it meets the subject matter of the invention.

Furthermore, as already explained with reference to FIG. 9A, it issufficient for the identifying information in the file to be related tothe identifying information in a redundancy block RDBlock in any sense.For example, a cipher key may be made on the basis of the identifyinginformation stored in the redundancy block RDBlock of the flash memorycard FMC so that the cipher file can be deciphered by using the cipherkey.

When the cipher file is deciphered by using the identifying informationin the redundancy block RDBlock in this manner, it means that theidentifying information in the redundancy block RDBlock coincides withthe identifying information in the file. That is, consistency orinconsistency between the identifying information in the redundancyblock RDBlock and the information related to the identifying informationin the file may be expressed as the cipher file being normallydeciphered or not.

Ninth Embodiment

Next explained is the ninth embodiment of the memory system according tothe invention, based on and reinforced from the eighth embodiment. Inthe eighth embodiment, since no method for prohibiting rewrite of theidentifying information is explicitly shown, there is the possibilitythat an illicit tool for rewriting data of the field is made if by anypossibility the method for accessing to the redundancy block leaks out.The embodiment shown here adds a transaction for prohibiting rewrite ofthe identifying information to the method disclosed as the eighthembodiment.

Referring again to FIG. 19, a specific example is explained. In case of64-Mbit flash memory card FMC, for example, its memory cell array isdivided into 1024 blocks (unit of erasure) Block 0 through Block 1023each of 64 kilobits. In addition to these 1024 blocks, eight redundancyblocks RDBlock 0 through RDBlock 7, for example, are prepared. In eachof these redundancy blocks RDBlock 0 through RDBlock 7, a row decodercircuit as shown in FIG. 20A is provided. Explanation is made onfunctions of the row decoder circuit.

The row decoder circuit takes the role of selecting a block according toan address input into the chip and transferring a voltage generated inthe peripheral circuit to a word line, for example. These operations aretypically performed in any of data write, data erasure and data readoperations. Next explained are operations of the row decoder circuitwith reference to FIG. 20A.

Signal RDEC is the start signal of the row decoder circuit, and becomes“H” for write, erase and read operations. Signal ADDRESS is a blockaddress. Solely in a block whose address is selected, all of a pluralityof address signals become “H”, and nodes NA also become “H”.

For write operation and read operation, signal ERASE becomes “L”, signal/ERASE becomes “H”, and a signal is transmitted to node NO through“signal path 2”. That is, node NO becomes “H” in the selected block, butbecomes “L” in the other blocks. Then, in the selected block, nodeN1=VPP (high voltage for realizing write, erase and read operations, forexample), and node /N1=0V. As a result, the voltage on the bus line ofthe peripheral circuit shown in FIG. 20B travels to the word line, anddata write or read operation is executed.

On the other hand, in any unselected block, node N1=0V, node /N1=VPP,and the bus line of the peripheral circuit shown in FIG. 20B and thework line are disconnected.

Next explained are detailed operations during erase operation. Beforeerase operation is started, since signal RESET is in the “H” level,nodes N1 and Nr are in the “H” and “L” levels, respectively. When eraseoperation is started, signal RESET changes to “H”, address signalADDRESS is set according to the address input to the chip, and signalLEST becomes “H” for a certain period of time. In the selected block,since node NA is “H”, if the fuse F is in the connected status, node NLis connected to 0V via the fuse F, and nodes NL and NR become “L” and“H”, respectively. In a block with the fuse F in the disconnectedstatus, regardless of the block being selected or not, nodes NL and NRmaintains “J” and “L”, respectively. Subsequently, signal ERASE becomes“H”, signal /ERASE becomes “L”, and the signal travels to node NOthrough “signal path 2”. That is, the voltage of the node NR propagatesto the node NO, and erase of data is executed only in blocks where thenode NR is in the “H” level.

As apparent from the foregoing explanation, the row decoder circuit inFIG. 20A does select or not select blocks for data write or readoperation by directly using the address signal, and does select or notselect blocks for data erase operation by using a latch circuit 41 inthe row decoder circuit. That is, it uses the latch circuit 41 made upof inverters I1 and I2. Therefore, by using the circuit in FIG. 20A, inblocks with the fuse F being cut, data write and read operations areenabled, and data erase operation is disabled.

When the row decoder is used, control operations are executed asfollows. For example, a command for accessing to a redundancy blockRDBlock is prepared. Then, identifying information exclusive to theflash memory card FMC is written in the redundancy block RDBlock. It hasalready been explained in the eighth embodiment, etc. that variousmethods are usable regarding the format for writing identifyinginformation. In this example, the fuse F is cut after the identifyinginformation is written. As already set forth, the fuse F may be alasercut fuse, electric fuse, EEPROM, etc. Once the fuse F is cut, writeand read operations are enabled, but erase operation is prohibited, asexplained before. Therefore, even if the method for accessing to thecorresponding redundancy block RDBlock leaks, information stored in thecorresponding redundancy block RDBlock cannot be rewritten freely.

However, this embodiment does not prohibit write operation to theredundancy block RDBlock. Therefore, additional write operation ispossible. Although the flash memory in the instant embodiment can berewritten from data “1” to “0” without erase operation, rewrite of data“0” to “1” is not possible. Therefore, when the identifying informationis stored in the flash memory card FMC, its complement may be writtensimultaneously in addition to the identifying information so that theidentifying information in the redundancy block cannot be changed toother identifying information even when the method for access is known.

That is, if “AAh=10101010” has been stored as the identifyinginformation in the redundancy block RDBlock, for example, as shown inFIG. 21A, “55h=01010101” is also stored as complement information of theidentifying information. As shown in FIG. 21B, it is possible to change“1” to “0” by illicit operation. Therefore, it is possible to change theidentifying information to “2Ah=00101010”, for example, by rewriting “1”of the most significant bit to “0”. However, the complement informationof the identifying information stored in the redundancy block RDBlockcannot be corrected properly. That is, although the complementinformation of the identifying information is “55H=01010101”, it cannotbe changed to “D5=11010101” because “0” cannot be changed “1” in theredundancy block RDBlock as explained above. That is, even if anyonecould rewrite the identifying information to “2Ah=00101010” byadditionally rewriting the most significant bit of AAh in theidentifying information written in the redundancy block RDBlock, hecannot rewrite the field for storing its complement information toD5h=11010101”.

By storing identifying information and its complement informationtogether in the redundancy block RDBlock in this manner, illicitadditional writing is disabled, and even if the method for accessing tothe corresponding redundancy block RDBlock and the method for additionalwriting are known, meaningful data rewrite operation to thecorresponding redundancy block RDBlock field is not possible.

Therefore, in the system apparatus configured to restrict operations ofthe file on the system by comparing identifying information written inthe redundancy block RDBlock for identifying individual flash memorycards with the identifying information or its related informationacquired in the file, even if someone could copy the file onto anotherflash memory card FMC, since the flash memory card FMC as thedestination of the transfer also has the field for similarly storingidentifying information and rewrite of the identifying information issimilarly restricted, the identifying information does not coincideswith the information in the file. Therefore, he cannot use the file onthe system apparatus, and the copyright of the literary work isprotected.

In the case where the identifying information is written in the field ofa redundancy block RDBlock when a manufacture stores a literary workafter shipment of the flash memory card FMC, after the identifyinginformation is stored in the redundancy block RDBlock, the fuse F iselectrically cut, if an electrical fuse, to prohibit later illicitrewrite of the identifying information.

Although only erase operation is prohibited here, write operation itselfof the field may be prohibited by similar means. Means for prohibitingerasure and writing is not limited to a fuse near the row decoder. It isacceptable to employ means for prohibiting operations of a circuit forgenerating a high voltage required for write and erase operations whenthe field is accessed. Any such means may be employable as desired.

Only if one or both of erase operation and write operation of the fieldis prohibited by some means after storage of the identifyinginformation, it will satisfy the subject matter of the invention. It isalso acceptable to provide a means again enabling erase and writeoperations through a complicated procedure after these erase or writeoperation is once prohibited.

The embodiment explained above is configured to store the identifyinginformation of the flash memory card FMC in the redundancy blockRDBlock. However, the invention is not limited thereto. It may be storedin an ordinary memory space field other than the redundancy blocksRDBlock. In the flash memory card FMC, registration of any defectiveblock in unit of each block is possible as explained before the systemmay be configured to prevent illicit rewrite of identifying informationby cutting a fuse or by other appropriate means, after defining acertain block as the block for storing the identifying information andthen actually writing the identifying information there. In order toprevent an ordinary system from trying to use this block as the ordinarydata storage field, in addition to storage of information related to theidentifying information, Block Status Area of the block may be marked toregister it as a defective block. As already explained, also in thesecases, information enabling to confirm that the identifying informationis certainly stored may be also stored together.

When using this method, since dead copy of data from a certain flashmemory card FMC to other media should be prevented, by writing theidentifying information on all flash memory cards FMC upon shipment andalso cutting the fuse, later erase operation, write operation or bothmay be prohibited. Therefore, only if the identifying information isstored in an ordinary memory space, and some means is provided toprohibit later erase operation, write operation or these both of thisfield, it will satisfy the subject matter of the invention.

For simplicity, the foregoing first to ninth embodiment have been simplyexplained as the identifying information of the flash memory card FMCbeing its identifying number. However, it is not limited only to theidentifying number of the flash memory card FMC, but may be anyinformation directly identifying the literary work (for example, in caseof a musical file, such as seller, singer, composer, songwriter,manufacturer, recor[0084] maker, album name, music title, etc. whichneed not be directly related to distinctiveness of the memory carditself).

Furthermore, as already explained with reference to FIG. 9A, it issufficient for the identifying information in the file to be related tothe identifying information in a redundancy block RDBlock in any sense.For example, a cipher key may be made on the basis of the identifyinginformation stored in the redundancy block RDBlock of the flash memorycard FMC so that the cipher file can be deciphered by using the cipherkey.

When the cipher file is deciphered by using the identifying informationin the redundancy block RDBlock in this manner, it means that theidentifying information in the redundancy block RDBlock coincides withthe identifying information in the file. That is, consistency orinconsistency between the identifying information in the redundancyblock RDBlock and the information related to the identifying informationin the file may be expressed as the cipher file being normallydeciphered or not.

Tenth Embodiment

Next explained is the tenth embodiment of the memory system according tothe invention. This embodiment is directed to a defending functionagainst a tool for making a dead copy of data between a plurality offlash memory cards FMC.

Here are made defective bits inside the flash memory FM of the flashmemory card FMC in a randomly appropriate frequency. That is, each flashmemory has a defective bit different from others. In the example of FIG.22, the position of the defective bit DEFB in the memory space in theflash memory FM in the flash memory card FMC(A) and the position of thedefective bit DEFB in the memory space in the flash memory FM of theflash memory card FMC(B) are different. In this manner, among aplurality of flash memory cards FMC, their defective bits are differentin location.

Even if anyone having such a flash memory card FMC tries to read outdata from the original flash memory card FMC and make a dead copy ontothe destination flash memory card FMC in order to copy the content ofthe nonvolatile flash memory FM as a recording medium, because thedefective bit exists in the flash memory FM in the destination flashmemory card FMC, the data is not written properly there. That is, in theexample of FIG. 22, if he tries to make a dead copy of the bit data D1of the flash memory card FMC(A) onto the flash memory card FMC(B), sincethe bit position of the memory space is the defective bit DEFB, hecannot copy it. Therefore, he cannot make the dead copy properly, andthe illicit data copy results in a failure.

Any of an inborn defective bit and an intentionally located defectivebit may be used as the defective bit DEFB, and both promise the sameeffect. Further, the defect need not be a bit effect, and the sameeffect is expected with nonvolatile memory having inborn orintentionally created row defects, column defects, block defects ortheir combination.

As means for intentionally creating defective bits, row defects, columndefects or block defects, cell transistors, row decoders, columndecoders or block decoders may be broken by laser irradiation. It isalso possible to provide a poly silicon fuse or an electric fuse betweena cell, row, column or block and its decoder and to fuse it by a laseror an overcurrent. Furthermore, by providing cells in nonvolatile memorysuch as one time PROM and by writing some material in the cells, any oneof the above-mentioned defects or any combination of them may be createdintentionally. Thus, such defects can be intentionally made by variousways not departing from the concept of the invention.

By using the technique explained in the eighth or ninth embodiment, oneor both of erase operation and write operation may be prohibited. Whenerase operation is prohibited solely, if “0” data is written previouslyin the field, data cannot be copied, and the same effects are obtained.If the system has some means which makes an attempt to make a dead copyof data be compelled to result in a failure, it will meet the concept ofthe invention.

Eleventh Embodiment

Next explained is the eleventh embodiment of the memory system accordingto the invention.

Although various modes of contrivance for protecting copyrights havebeen explained in the first to tenth embodiments, it is also possible toenable discrimination between memory cards including the function ofcopyright protection and other cards having no such function. There arevarious modes of discrimination. For example, written notice or logoapplied onto an outer surface of a memory card to demonstrate that ithas a function of copyright protection is also usable for this purpose.Alternatively, by making some rule on colors or patterns, they may beused to demonstrate that it has the function of copyright protection.Also, such notice may given by the product name or the model number ofthe product. It is also acceptable to give message on a display, forexample, when the system apparatus is inserted. Additionally, althoughalready explained, a specific operation (such as special commandoutputting whether it supports the function of copyright protection) maybe used to distinguish a portion corresponding to the controller in thesystem apparatus.

It is also possible to design so that discrimination of the presence orabsence of the above-mentioned copyright protection can be made for eachfile or each directory. Additionally, taking account of literary worksnot requiring protection, such as private musical works orpromotion-purpose musical pieces, means for discriminating thoserequiring protection from those not requiring protection may beprovided. By proving a flag, for example, in a predetermined field in afile, the flag may be used to enable the use of a file on a systemapparatus even when conditions about copy right protection explainedheretofore are not satisfied, if the file is judged to require nocopyright protection.

Although the first to eleventh embodiments have been explained takingflash memory cards FMC as an example, the invention is not limited toflash memory cards or semiconductor memory. The entire of a card may bea mask ROM (MROM) (in this case, identifying information, etc. explainedin the first to eleventh embodiments may be configured as MROM), orflash memory capable of data write or setting identifying information,OTP (one time PROM), fuse, etc. may be attached together with MROM inorder to add the functions as explained in the first to eleventhembodiments.

Furthermore, the invention is not limited to the foregoing embodiments,but it can be modified in various modes without departing from itsconcept. Additionally, protection of copyrights need not be used in amode shown in the first to eleventh embodiment or combining them, butelectric transparency techniques and cipher techniques may be combinedto these embodiments or their combinations.

Twelfth Embodiment

The twelfth embodiment of the invention is directed to a specificcontrol method of a state change storage field permitting data writeonly once in the flash memory card FMC.

First explained is the mechanism of copyright protection employed inthis embodiment with reference to FIGS. 23 and 24. FIG. 23 is a diagramexplaining a setup for copyright protection in case of moving anapproved file. FIG. 24 is a diagram explaining a setup for copyrightprotection when unapproved file copy is attempted).

As shown in FIG. 23, the flash memory card FMC(A) is for use in thesystem apparatus having apparatus number 100. The mark data of the flashmemory card FMC (A) is 5. The flash memory card FMC(A) stores anapproved literary work file FL1. In the file FL!, the apparatus number100 is installed as the identifying information, and informationindicating that the mark data is 5 is also installed.

Assume here that the file FL1 of the literary work stored in the flashmemory card FMC (A) is licitly moved to another flash memory cardFMC(B).

In this case, the end user first moves the file FL1 from the flashmemory card FMC(A) to the hard disc, for example, of a personalcomputer. The term “move” is used that the original file FI1 heretoforestored in the flash memory card FMC(A) is erased therefrom andsimultaneously copied to the personal computer PC. Therefore, by movingthe file FL1 to the personal computer PC, the file is lost in the flashmemory card FMC(A). When the file FL1 is moved, the mark data is countedup from 5 to 6. The mark data is controlled on the hardware not to countdown. That is, the mark data having changed from 5 to 6 cannot be nolonger returned to 5.

Subsequently, the end user moves the file FL1 from the had disc of thepersonal computer PC to the flash memory card FMC(B). Upon thismovement, the personal computer PC reads the apparatus number 200 of theflash memory card FMC(B) and a mark data 10, and after creating a fileFL2 incorporating these data, delivers it to the flash memory cardFMC(B). Since different flash memory cards have different values of themark data, the personal computer creates the new file FL2 in compliancewith the unique number of the mark data. Due to the movement, the dataof the file FL1 heretofore stored on the hard disc of the personalcomputer PC is erased. Through these operations, the file FL1 in theflash memory card FMC(A) for the apparatus number 100 can be moved as afile FL2 to the flash memory card FMC(B) for the apparatus number 200.

With reference FIG. 24, explanation is made below about the reason ofthe irreversible count-up of the mark data of the flash memory cardFMC(A).

Assume that the end user previously made a backup copy of the file FL1of the literary work in the flash memory card FMC(A) into a personalcomputer, for example, in some form prior to movement thereof to thepersonal computer PC, as shown in FIG. 24. Since the backup file FL3 inthis case is just the backup copy, the file FL3 still includes theapparatus number 100 and the mark data 5.

Next assume that the end user moved the file FL1 in the flash memorycard FMC (A) to the flash memory card FMC (B) according to the procedureexplained above. Then, the flash memory card FMC(A) changes to a flashmemory card storing no file therein, having the apparatus number 100 andthe mark data 6.

Further assume that the backup file FL3 is copied as another backup copyonto the blank flash memory card FMC(A). However, the mark data of theflash memory card FMC(A) has already changed to 6 as explained above. Onthe other hand, in the backup file FL3 returned back to the flash memorycard FMC(A), the mark data 5 still remains. And, the mark data value ofthe flash memory card FMC (A) cannot be returned from 6 to 5. Therefore,the backup file FL3 is not usable on the flash memory card FMC(A).

In this manner, by irreversibly counting up the mark data value of theflash memory card FMC when the file is moved, it is possible to preventillicit copy of the file of the literary work.

Next explained is a specific embodiment of the flash memory forrealizing the setup for copyright protection.

FIG. 25 shows the entire structure of NAND EEPROM flash memory accordingto the embodiment, FIG. 26 shows the structure of blocks of its memorycell array 1, and FIG. 27 shows the structure of a single block Bi.

As shown in FIG. 27, each memory transistor (memory cell) MC of the NANDEEPROM flash memory has a FETMOS structure made by stacking a floatinggate in which a floating gate (charge storage layer) and a control gateare stacked on a semiconductor substrate via an insulating film. Then, aplurality of memory transistors are serially connected, with a sourceand a drain commonly used by every two adjacent memory transistors, toform a single-unit NAND cell, and the NAND cell is connected to a bitline. A number of such NAND cells in a matrix arrangement form a memoryarray shown in FIG. 1. The memory cell array 1 is integrated on a p-typesubstrate or a p-type well.

As shown in FIG. 27, drains at one end of NAND cells aligned in rowdirections of the memory cell array 1 are connected to bit lines BL viaselection gate transistors S1, and sources at the other end areconnected to a common source line via selection gate transistors S2.Control gates of memory transistors MC and selection gate transistorsS1, S2 are connected commonly connected as control gate lines CG0through CG15 and selection gate lines SG1 and SG2 in column directionsof the memory cell array 1. Control gate lines CG0 through CG15 normallyform word lines WL0 through WL15.

In FIG. 27, 16 memory transistors MC form a 16-stage NAND. This NANDcell executes data write, erase and read operations by controllingvoltages of the bit line BL, control gate lines CG and selection gatelines SG. All of a plurality of NAND cells in FIG. 27 commonly share acontrol gate. A group of these NAND cells sharing a control gate isnormally called a block, and this one block is the minimum unit of dataerasure. Typically, hundreds to thousands of blocks are arranged in thememory cell array 1. Each area in the clock selected by a single controlgate line is one page, and this one page is the area enabling collectivewrite or read operation.

As shown in FIG. 25, an address is acquired by an address buffer 4 anddecoded by a row decoder 2 and a column decoder 3. Thereby, selection ofa control gate line CG and selection of a bit line BL in the memory cellarray 1 are executed. A sense amplifier/data latch 5 detects selecteddata of the memory cell array 1, and latches write data introduced fromoutside through a data buffer 6.

A control circuit 7 receives a command, thereby generates variouscontrol signals such as data erase control signal, and controls avoltage generating circuit 8 the voltage generating circuit 8 generatesa step-up voltage, negative voltage, and so on, necessary for data writeand erase operations.

This NAND EEPROM operates as explained below. For data write operation,a high voltage Vpgm (approximately 20V) is applied to the control gateof selected memory cells, an intermediate potential Vpass (approximately10V) is applied to control gates of the other memory cells, and 0V orsource voltage Vcc (approximately 3 to 5V) is applied to the bit lines,depending upon the data. When 0V is applied to the bit lines, thepotential is transmitted up to the drain of the selected memory cell andthe channel portion, and electrons are injected from the drain to thefloating gate. As a result, the threshold value of the selected memorycells shifts toward the positive direction. Let this status be “0”, forexample. When the source voltage Vcc is applied to the bit line,injection of electrons does not occur. Therefore, the threshold valuedoes not change but remains negative. This status is the initial statusof memory, and “1”. Details of write operation and its principle areexplained later.

Data erasure occurs simultaneously in all memory cells within theselected NAND cell block. That is, in the selected cell block, allcontrol gate lines are changed to 0V, and a high voltage ofapproximately 20V is applied to the bit lines, source lines p-type well(or p-type substrate), control gate lines CG in unselected NAND cellblocks and all selection gate lines SG. As a result, in all memory cellsin the selected NAND cell block, electrons in the floating gates arereleased to the p-type well (or p-type substrate), the threshold voltageshifts toward the negative direction, and data “1” is established.

Data read operation is executed by applying 0V to the control gate ofselected memory cells, applying the source voltage Vcc to the controlgates of the other memory cells and selection gates, and detectingwhether a current flows or not in the selected memory cells.

In the embodiment shown here, among a plurality of NAND cell blocks Biof the memory cell array 1, one block B0 shown by crosshatching in FIG.26, for example, is determined as an OTP block which is a state changestorage field permitting only once data writing, that is, a field inwhich data erasure is impossible. In this OTP block, it is necessary tostore a mark data indicating an irreversible change of state whilepreventing erroneous writing, and a control method for this purpose isimportant. A specific control method will be explained later.

In order to prohibit data erasure of the OTP block, a fuse circuit isadded in each block decode portion in the row decoder. FIG. 28 shows anexample of the structure of a decode portion RDi corresponding to theblock Bi in the row decoder 2. The row decoder 2 takes the role ofselecting a block according to an address input into the chip andtransferring a voltage generated in the peripheral circuit to thecontrol gate, selection, etc., and effectuates data write, data eraseand data read operations.

Signal RDEC is the start signal of the row decoder 2, and becomes “H”for write, erase and read operations. Signal ADDRESS is a block address.Solely in a block whose address is selected, all of a plurality ofaddress signals become “H”, and output nodes NA of decode gates eachmade up of a NAND gate G1 and an inverter I1 become “H”. That is, thenodes NA become “H” only in the selected block and “L” in the otherblocks.

Status of the node NA is inverted through an NMOS transistor QN2 andtransferred to a node NL in a latch circuit. The latch circuit 41 isprovided to hold an erase select flag indicating that the block is underselection during erasure of data. That is, for the selected block, thelatch circuit 41 holds the node NL in “L” and the node NR2 in “H”.However, the NMOS transistor QN2 is grounded via the NMOS transistor QN1and through the fuse F. Whether the fuse is cut or not determineswhether the block should be changed to OTP, and it is programmed in thewafer stage.

More specifically, in the block with its fuse F being cut, the NMOStransistor QN2 is not grounded, and the latch circuit 41 cannot hold theerase select flag (NL=“L”, NR=“H”) even when the block is selected. As aresult, the block in which the fuse F is cut is changed to an OTP blockprohibiting data erasure therein.

Data on the node NA and data on the node NR of the latch circuit 41 areselectively transferred to the node N0 by transfer gates TG1 and TG2which are controlled by an erase control signal ERASE generated from acontrol circuit 7. That is, during data write or read operation, ERASEis “L”, transfer gates TG1 is ON, TG2 is OFF, and therefore, data on thenode NA is transferred to the node NO. During data erasure, transfergate TG1 is OFF, TG2 is ON, and data on the node NR in the latch circuit41 is transferred to the node N0.

In response to the data on the node NO, output voltage VSE from avoltage generating circuit 8 (or Vcc) is transferred to signal lines N1and /N1 as a complement signal voltage by a transfer switch 42. That is,in the selected block with N0=“H”, PMOS transistor QP1 of the transferswitch 42 is OFF, QP″ is ON, N1=VPP (high voltage for effectuatingwrite, erase and read operations, for example), and /N1=0V. These signallines N1 and /N1 controls transfer gates TG3, TG4, . . . to turn ON, adrive voltage from a bus line of a peripheral circuit propagates to thecontrol gate lines CG and the selection gate lines SG of the memory cellarray. As a result, data write and read operations are executed. Inunselected blocks, N1=0V, /N1=VPP, and control gate lines and selectiongate lines are under disconnection from the bus line of the peripheralcircuit.

Remarking the row decoder of FIG. 28, data erase operation is explainedin detail. Before the erase operation starts, a reset signal RST is “H”,NMOS transistor QN3 is ON, and in the latch circuit 41, node NL and nodeNR are “H” and “L”, respectively. When the erase operation starts, thereset signal RST changes to “L”, the address signal ADDRESS isdetermined according to the address input into the chip, and signal LSETbecomes “H” for a predetermined time. In the selected block, node NA is“H”. Under the situation, if the fuse F still remains uncut, node NL isconnected to 0V through the fuse F. Therefore, nodes NL and NR become“L” and “H”, respectively. On the other hand, in a block in which thefuse is already cut, regardless of the block being selected orunselected, nodes NL and NR remain “H” and “L”, respectively.Subsequently, the erase control signal ERASE becomes “H”, and the statusof node NR of the latch circuit 41 is transmitted to the node NO throughthe transfer get TG2. That is, data erasure is executed solely in theblock in which the node NR is in the “H” level.

FIG. 29 is a diagram which shows timing of the data write operation, andFIG. 30 is a diagram showing the corresponding bias condition. Thetiming diagram of FIG. 29 corresponds to the operation in the case whereCG14 is selected among 16 control gate lines (word lines) in theselected block. When the write operation starts, the bit lines BL arecharged to 0V or Vcc, depending upon the data to be written, and theselection gate line SG1 is charged to Vcc. At that time, in the NANDcell for writing “0” therein (NAND cell B in FIG. 30), 0V is transferredto the channel portion of the memory transistor MCB through theselection gate transistor S1 driven by the selection gate line SG1. Onthe other hand, in the NAND cell for writing “1” therein (that is,prohibiting to write “0”) (NAND cell A in FIG. 30), the selection gatetransistor S1 turns OFF after transferring voltage up to Vcc-Vt (Vt isthe threshold voltage of the selection gate transistor S1) therefore,the channel portion of the memory transistor MCA changes to a floatingstate of a level higher than the NAND cell B on the part for writing“0”.

After that, the selected control gate line CG14 changes from 0V toVpgm=20V, and the unselected control gate lines CG0 through CG13 andCG15 change from 0V to Vpass=10V. As a result, in the NAND cell B forwriting data therein, since the channel portion of the selected memorytransistor MCB is fixed to 0V, a high voltage is applied to the controlgate line CG2, a potential difference as large as 20V is producedbetween the control gate and the channel portion. Therefore, electronsin the channel portion are injected into the floating gate by tunneling.Thus, the threshold value voltage of the memory transistor MCB shiftstoward the positive direction. That is, data “0” is written.

Still in the NAND cell B for writing “0” therein, in an unselectedmemory transistor, MCC, for example, since the potential differentbetween the control gate and the channel portion is 10V, not so large,electron injection to the floating gate does not occur, and thethreshold voltage of the memory transistor does not change. In the NANDcell A for writing “1”, however, since the channel portion of the memorytransistor MCA is currently under floating, even when the control gatevoltage increases, such as 0V620V, the potential of the channel portionalso increases to Vboost (−8V) because of capacitance coupling.Therefore, the potential difference between the control gate and thechannel portion is approximately 12V, and electron injection to thefloating gate is difficult to occur, and the threshold voltage of thememory transistor MCA does not change so much. Also in memorytransistors driven by the other unselected control gate lines suppliedwith the pass voltage Vpass, writing does not occur.

FIG. 31 shows a diagram showing the timing of data read operation. Thebit line BL is pre-charged to Vcc. Then, Vcc is applied to the selectiongate lines SG1, SG2, the same Vcc is simultaneously applied also to theunselected control gate line CG0 through CG13 and CG15, and the selectedcontrol gate line CG14 is held in 0V. As a result, depending on “0” or“1” of the selected memory transistor, a current flows or does not flowin the bit line BL, and “0” and “1” can be detected, respectively.

In the embodiment shown here, the OTP block exhibits all “1” in theinitial status, and mark data as many as possible are written here. Asexplained later more specifically, by sequentially writing mark data ofall “0” in unit of one byte, for example, changes of the status arestored. Therefore, the OTP block is divided in the row and columndirections, and only write operation is repeated in respective unitareas. Therefore, erroneous writing is liable to occur with a largepossibility. Because of this reason, for writing mark data in the OTPblock, it is desirable to employ a method minimizing erroneous writing.For this purpose, it is necessary to know which conditions are liable tocause erroneous writing.

Under the bias condition for data write shown in FIG. 30, since there isa difference in condition of voltages between the memory transistor MCAsupplied with a high voltage to its control gate within the NAND cellgiven with data “1” and the unselected memory transistor MCC in the NANDcell B given with data “0”, there is a difference also in liability oferroneous writing. In this case, erroneous writing is more liable tooccur in the former because, in the above-explained example ofoperation, the potential difference between the control gate and thechannel portion of the selected memory transistor MCA for writing data“1” is 12V, and it is larger than the potential difference 10V betweenthe control gate and the channel portion of the unselected memorytransistor MCC in the NAND cell B for writing data “0”.

On the other hand, in the data read operation as shown in FIG. 31, sincethe potential difference between the control gate and the channelportion is normally about Vcc maximum, almost no erroneous writephenomenon occurs during read operation.

Therefore, in order to erroneous writing, there are two key points,namely, minimizing the potential difference between the control gate andthe channel portion of the selected memory transistor for writing data“1” (increase the voltage of the channel portion as high as possible),and minimizing the frequency of writing data “1”.

Additionally, from the viewpoint of the sequence of data write in asingle NAND cell, the probability of erroneous write phenomenon can bereduced by progressing writing in sequence from the memory transistorclosest to the cell source line. This is explained with reference toFIG. 32 and FIG. 33. As explained above, the voltage of the channelportion of the selected memory transistor for writing data “1” increasesto the floating level, with Vcc-Vt pre-charged from the bit line BL, andupon an increase of the voltage of the control gate line, it increasesby capacitance coupling. It is apparent that the higher the voltage atthe start of the voltage rise due to capacitance coupling (theinter-channel voltage under 0V in all control gates), the higher thefinal arrival voltage of the channel portion (maximum voltage value ofthe channel portion).

FIG. 32 shows the aspect in which, in the status with data “0” beingwritten in the memory transistor closest to the cell source line in theNAND cell, Vcc is applied to the selection gate line SG1 nearest to thebit line, 0V is applied to all control gates, and Vcc applied to the bitline BL is transferred to the channel of the NAND cell. FIG. 33 showsthe aspect in which, in the status with data “0” being written in thememory transistor closest to the bit line in the NAND cell, Vcc isapplied to the selection gate SG1 line nearest to the bit line, 0V isapplied to all control gates, and Vcc applied to the bit line BL istransferred to the channel of the NAND cell.

As shown in FIG. 32, in the case where “0” (Vt(cell)=1V) is written inthe memory transistor on the control gate line CG0 nearest to the cellsource line, if all of the threshold values Vt(cell) in the remaindermemory cells nearer to the bit line are in the state of “1” in thenegative side (≦+(Vcc-Vt)), the potential Vcc-Vt can be transferred tothe channels of the remainder memory transistors from the bit line BL.On the other hand, assuming that data “0” is written in the memorytransistor nearest to the bit line BL, shown in FIG. 33, even byapplying Vcc to the bit line BL, the channel regions of the memorytransistors nearer to the source line than the memory transistor alreadywritten with data “0” cannot be pre-charged due to disturbance by thethreshold value 1V of the memory transistor with data “0”, and they getinto a floating state of approximately 0V.

In this manner, if “0” is written earlier in a memory transistor nearerto the bit line, channels of memory transistors farther from the bitline cannot be pre-charged sufficiently. This can be a cause oferroneous writing. Therefore, it is important for preventing avoidableerroneous writing to progress data write successively from one nearestto the cell source line so as to always hold the unwritten status (“1”)in memory transistors nearer to the bit line from than the memorytransistor for writing.

FIG. 34 shows a method for writing mark data in the OTP block in thisembodiment, taking account of the viewpoint of preventing erroneouswriting. In the embodiment shown here, the OTP block is one block whichis the minimum unit of data erasure, and it includes 16 pages Page 0through Page 15 each being the area belonging to one control gate lineCG. One page is made up of 528 bytes, and the OTP block is sectionedinto unit areas for writing mark data, in the unit of one byte in thecolumn direction as illustrated. Then, as mark data storing changes instate, “00h” which is all “0” is successively written in the unit of onebyte. In the OTP block, once the data “0” is written, the data cannot bereturned to “1”. Therefore, In the embodiment shown here, since 528bytes×16 pages=8000 approximately, irreversible changes of state can bestored approximately 8000 times.

Writing of mark data “00h” in the unit of one byte into each area of theOTP block is progressed, as indicated by arrows in FIG. 34, in the orderfrom (Page 0, Byte 0) to (Page 1, Byte 0), (Page 2, Byte 0), (Page 2,Byte 1), . . . by switching the row address every one byte (changing thepage). When the writing progresses to (Page 15, Byte 0), the processreturns to Page 0, and progresses writing of mark data “00h” whileincrementing the address in the row direction like (Page 0, Byte 1),(Page 1, Byte 1), (Page 2, Byte 1), et. seq.

Regarding the writing sequence of the mark data, it is essentiallypossible to increment the address in the column direction like Byte 0,Byte 1, . . . in Page 0 and to move to the next page Page 1 after themark data is written in all bytes of Page 0. However, in this method,there is a high probability that erroneous writing occurs often before anumber of changes in state are stored. This can be explained as follows,remarking (Page 0, Byte 527).

Until the mark data is written in (Page 0, Byte 527), operation forwriting data “1” under application of a high voltage to the control gateis repeated 527 times in the very memory transistor. This condition isthe same whether the address is incremented in the row direction or inthe column direction. However, when it is incremented in the columndirection, operation of even one page is not finished, until writing ofmark data progresses to (Page 0, Byte 527). In contrast, in the methodaccording to the embodiment configured to increment the address in therow direction, 526×16 changes of state are already stored until the samestress is applied in the same position (Page 0, Page 527).

Therefore, according to the embodiment shown here, it is possible towrite much of the mark data on condition that the memory transistor notyet written in the OTP block does not receive a useless stress.

According to the embodiment shown here, page 0 corresponds to thecontrol gate line CG0 nearest to the cell source line in the OTP block,and data write is executed from the position nearest to the cell sourceline within the NAND cell in the OTP block. This also contributes todecreasing the probability of erroneous writing.

FIG. 35 shows a flow chart of the operation of incrementing the addressfor writing mark data in the OTP block. In step S1, page address Pageand the maximum page address PageMAX in the OTP block are compared. Ifthe current page address is not the maximum page address (PageMAX=15 inthe example of FIG. 34), the page address is imply incremented (StepS2). If the current page address is judged to be the maximum pageaddress in step S1, the procedure jumps to the routine of step S3, andby confirming the column address Col is not larger than the maximumcolumn address ColMAX, resets the page to 0 (returns to the first page)(step S4) and increments the column address (step S5). In step S3, ifthe column address is the maximum column address (Byte 527 in theexample of FIG. 34), since the address cannot be incremented any moreeither in the row direction or in the column direction, the procedurefinishes in Error.

Next explained is an algorithm for improving the reliability of markdata write operation in the OTP block. As already explained, there is apossibility of erroneous writing in which data “1” transforms to data“0”, due to the stress against data write of “1”, that is, the stressapplied to the remainder memory transistors while the mark data “0” iswritten in a certain byte, and it is desirable to deal with the matter.This routine, however, will not be necessary, depending on thereliability level required in the system or the reliability level of thememory transistors themselves.

Here is provided a measure in the process of judgement whether a byte isone written with mark data “00h” or not for realization of irreversiblechanges of state. That is, this is judged from the “0” bit number in onebyte. More specifically, in the embodiment shown here, at least six bitsare “0” in one byte (8 bits), this byte is judged to be one written withthe mark data. Next explained are reasons of improvement in reliabilityby such judgement.

In the present invention, it is important where is the boundary betweenbytes with the mark data “00h” and bytes without it. If this boundary isvague, reliability decreases so much. For example, assume that a certainbit is undesirably written with “0” in a byte in which writing of themark data is not yet executed due to a stress. In this case, even though“0” has been written in one bit, the “0” bit number in this byte isstill 1 and has not yet reached 6. Therefore, this byte is never judgedas being an already written byte.

Flash memory, in general, has a data holding property. This is thephenomenon in which data “0”, certainly written once, returns to “1” dueto a progress of time after writing the data, for example. In general,flash memory holds data by injecting electrons into an area calledfloating gate encircled by an insulator by a tunneling current or by hodelectron injection. If the insulator encircling the floating gate has abad quality, electrons once confined may externally leak with time, andthis may results in returning the bit from the “0” status to theoriginal “1” status. Also for the defective mode, the operation ofcounting the “0” bit number is effective.

For example, let one bit have returned to “1” in a certain byte in whichthe mark data “00h” had been written. In this case, if the judgementsimply relies on whether the byte is “00h” or not, this byte ismisjudged as an unwritten byte. However, by using a means for countingthe “0” bit number, even after the “0” bit number has been reduced from8 to 7, this number of “0” bits still satisfies the condition “not lessthan six bits”, and the byte is therefore properly judged as a bytealready written with the mark data. In this manner, the method ofjudging the boundary between unwritten areas and written areas bycounting the “0” bit number in each byte can provide a margin againstboth the problem of transformation of data “1” to data “0” due to astress in an unwritten area of the OTP block and the problem oftransformation of data “0” to data “1” in areas already written with themark data due to the data holding property of the flash memory, andtherefore improves the reliability remarkably.

FIG. 36 and FIG. 37 are flow charts which show a control flow forsearching the boundary between the area written with the mark data andthe unwritten area in the OTP block, that is, for searching whether anarea is blank or not. Initializing the row address RowAdd and the columnaddress ColAdd, the search is started from (Page 0, Byte 0) (step S11).Instep S12, it is judged whether it exceeds the maximum column addressColMAX or not. Since the maximum address in the column direction is Byte527, it is not necessary to search a blank address in excess of it. Instep S13, it is confirmed whether the “0” bit number Num is 6 or larger,or not. If the “0” bit number is 6 or larger, the column address isincremented by one address to search into the next column (step S15).This operation to count the n bit number is repeated.

In step S14, if any byte having “0” bits less than 6 is found, theprocedure moves to step S16 in FIG. 37. Here is judged whether thecolumn address of the byte found to be not written with “00h” is thefirst column (Byte 0) or not, and if it is other than the first columnaddress, the procedure returns to the address younger by one than thecolumn address (step S17) to start the search in the row direction. Ifthe column address of the byte found to be not written with “00h” is thefirst column (Byte 0) or not, since it is an area having never beenwritten with “00h”, the current address is (Page 0, Byte 0). In step S18et seq., the procedure proceeds to the search in the row direction. Itis first judged whether the row address RowAdd is smaller than or equalto the maximum row address RMAX or not, and if it is smaller than orequal to the maximum row address, namely, smaller than or equal to Page15, the “0” bit number is counted in step S19. Then, by judging whetherthe “0” bit number Num is at least 6 or not (S20), and if YES, the rowaddress is incremented (step S23), and the procedure returns to step S18to repeat these steps.

If any byte having “0” bits less than 6 is found in step S20, the byteis determined to be the current row address CRAdd and column addressCCAdd (the byte indicating from which the data is not written) in stepS24. If no byte with “0” bits less than 6 is found even after searchingup to the final page (Page 15 in this example) in response to judgementin step S18, the procedure moves to processing of step S21. In thisstep, if the address in the column direction is the maximum columnaddress ColMAX (Byte 527 in this example), since it indicates that allbytes in this block are filled with the mark data “00h” and hence meansthat the OTP has no byte defined as the first address not written withthe data, and the procedure finishes as Error (S25). If the columnaddress is not the maximum column address ColMAX, it means that the markdata “00h” has been written up to just the final page of a certaincolumn. Therefore, in step S22, the value returned to the originaladdress by adding one address to that once taken by subtracting oneaddress from the original address is determined as the current columnaddress CCAdd.

Although the foregoing explanation is directed to the method forsearching the first one of addresses in which the mark data has not beenwritten currently, its procedure is not limited to this example. It isalso possible to simply progress the search from Page 0 to Page 15 ofthe first column and then increment one address so as to continue thesearch from Page 0 to Page 15 of the next byte Byte 1. Furthermore, anymethod may be employed provided that it ensures judgement of theboundary between an address written with the mark data “00h” and anotherwithout the data.

Next explained is a technique for writing mark data with a highreliability, in combination with the technique for searching theboundary area for wring the mark data in the OTP block by counting the“0” bit number. Following the above-explained example, here is taken thecase in which the existence of six or more “0” bits in one byte isdetermined to indicate that the data is written in the byte. Assume herethat, if “0” is erroneously written in five bits among eight bits by theabove-mentioned stress. Such case is rare, but this byte is judged to benot written with the data from the above-explained standard ofjudgement. However, this number of erroneously written “0” bits isdifferent by only one bit from six bits as the critical value forjudgement. Therefore, the byte is in an unstable status, whenever it mayfall in the status with six or more “0” bits and be judged as beingalready written with the data. From the viewpoint of reliability, it isa serious problem to leave such unstable bytes not yet written with thedata.

To overcome this problem, the embodiment shown here is configured not toleave any unstable areas not yet written with the data by the techniqueexplained below. That is, just after writing the mark data in a certainbyte, the byte for next writing the data is investigated. If it has “0”data in four or more bits, for example, the mark is written also in thisbyte precedently. Therefore, no byte having “0” bits less than or equalto three in its initial status remains in the area for next writing thedata. Since the OTP block merely undergoes write operation before thenext write operation, there is a very little possibility that a bytesuddenly changes from the status having three or less “0” bits to thestatus having six or more bits. In this manner, upon writing the markdata, by precedently judge the status of the area to be next writtenwith the mark data so as to remove unstable areas to be next writtenwith the data, a system with a high reliability can be realized.

Taking the above-mentioned point into consideration, next explained is apreferable method for writing the mark data in the OTP block.Essentially, the mark data “00H” is written in the current address, thatis, the first address among those not yet written with the data.However, the embodiment shown here employs a technique for improving thereliability. First explained is the basic concept of the method forwriting the mark data with reference to FIG. 38.

As explained heretofore, an important feature of the invention lies inthat the boundary address between a address already written with themark data and an address without it. Definition of the address alreadywritten with the data is the existence of six or more “0” bits. However,assume here that there is a byte having five or more “0” bits due to astress even though the mark data has not been executed. In this case, ifthe “0” bit number changes to 6 occasionally, the most important currentaddress will be lost.

This is explained more specifically with reference to FIG. 38. In FIG.8, write operation of the mark data “00h” has progressed to (Byte 2,Page 1) in the OTP block as shown by crosshatching. In order to keep theboundary condition, status of the byte labeled with “caution 1” and“caution 2” is important. If the status of the byte marked “caution 1”is unstable (for example, it has six “0” bits), the boundary may move.The byte marked “caution 2” also involves the same anxiety. When tsearching the current address, the above-explained embodiment isconfigured to conduct the search first in the column direction. However,if the byte marked “caution 2” is unstable (liable to change to a bytewritten with “0”), the boundary may move. Therefore, the status of twolocations, namely, the next row address (corresponding to the bytemarked “caution 1”) and the next column (corresponding to the bytemarked “caution 2”) has a significant meaning for a certain currentaddress.

Therefore, the embodiment shown here employs the technique explainedbelow. That is, after the mark data is written in a certain address, ifthe next row address in the same column (corresponding to the bytemarked “caution 1”) and the first row address in the next column(corresponding to the byte marked “caution 2”) are unstable, the markdata is simultaneously written also in these bytes. The boundary of theunstable status is defined to have four or more “0” bits for the timebeing. Therefore, if a byte has 0, 1, 2, or 3 “0” bits, it is maintainedas an area for next writing the data, and if it has four or more “0”bits, the mark data is written therein before the “0” bit number changesto 6 or more and the boundary becomes vague.

With reference to FIGS. 39 through 41, a more specific technique forwriting the mark data is explained. Numerals in blank areas withoutcrosshatching in these drawings (areas not yet written with the data)show how many “0” bits currently exist there. In case of FIG. 39, assumethat writing of the mark data “00h” has been executed in the bytemarked(A). The area for next writing is the byte marked (B). The “0” bitnumber of this byte is 0. Also in the position (C) which is the firstpage in the next column, the “0” bit number is 0, and its status isconsidered sufficiently stable. Therefore, in this status, the processof writing the mark data is finished.

Next discussed is the case of FIG. 40. Assume that writing of the markdata “00h” is executed in the byte marked (A). The area for next writingis the byte marked (B). The “0” bit number of this byte is 4, and itsstatus is considered unstable. Therefore, simultaneously with writingthe mark data in (a), writing of the mark data is executed also in thelocation marked (B). The “0” bit number is 0 in the byte marked (C), andits status is stable. Therefore, this area (C) is determined as the areafor next writing. Since the area marked (D) at the first page of thenext column is also normal, the process of writing the mark dataterminates here.

Next explained is the case of FIG. 41. Assume that the mark has beenwritten in the area (A). The byte as the area (B) for the next writingis normal. However, since the area (C) at the first page in the nextcolumn is unstable, the mark data is written simultaneously also in thearea (C). Since the area (D) as the next writing area subsequent to thearea (C) and the area (E) at the first page in the next column are alsostable, the process of writing the mark data terminates here.

When the mark data is written in the region (C), the mark data may bewritten also in areas from (Byte 2, Page 3) through (Byte 2, Page 15).

A detailed control flow of the process of writing the mark data asexplained with reference to FIGS. 38 through 41 is shown in FIGS. 42 and43, and its control operation is explained. In step S31, the address ofa byte to be next written with the data is set as the current row andcolumn addresses CRAdd and CCAdd. Then, in step S32, writing of the markdata “00h” is executed in the current address. In this step, writing ofthe mark data may be executed solely in the byte or may be executedsimultaneously also in areas already written with the mark data. In stepS33, it is confirmed whether the writing of the mark data has beenexecuted normally or not.

If the writing did not finish normally, the procedure moves to step S42in FIG. 43. In step S42, it is judged whether the byte having failed inwriting is the first page or not. If the writing failed in the firstpage, the procedure ends as error (step S47). If the byte having failedin writing is not the first page, the procedure moves to step S43. Inthis step, it is judged whether the column address has reached themaximum column address ColMAX or not, and if it is not less than it, theprocedure ends as error (S47). If the column address is less than themaximum column address, the procedure moves to step S44. In this step,the column address is incremented, and the row address is returned tothe first page. Subsequently, writing of the mark data is executed instep S45. This process means that, even when writing in a byte fails,only if the mark data is successfully written in the first address inthe next column, the byte in which writing resulted in fail may bedisregarded.

In step S46, it is judged whether the mark data was written in the firstpage or not. If it resulted in fail, the procedure ends as error (S47).If the writing was successful, the procedure moves to the routine forjudging whether the next write area and the first page address in thenext column are unstable or not, that is, step S34 in FIG. 42. In thisstep, it is judged whether the current row address RowAdd is less thanthe maximum row address RMAX or not, and if so, after incrementing therow address RowAdd in step S35, the “0” bit number is counted in stepS36. Then, in step S37, it is judged whether the “0” bit number Num isless than four bits or not. If so, since it means its stable status, theprocedure moves to the routine for confirming whether the first page inthe next column is stable or not, that is, step S38 in FIG. 43. If it isunstable, the procedure returns to step S32, and by writing the markdata in that address, its unstable status is removed.

In step S38, it is judged whether the current column address ColAdd isless than the maximum column address ColMAX or not. If the currentposition is the maximum column address ColMAX, the step of confirmingthe first page in the next column is not necessary, and the procedureends. If it is less than maximum column address ColMAX, the columnaddress CoLAdd is incremented in step S39, the row address RowAdd isreturned to the first page, and the “0” bit number in the byte iscounted in step S40. Then, in step S41, it is judged whether the “0” bitnumber is less than 4 or not, and if YES, the process is finished byjudging its state being stable. If it is in an unstable status with fouror more “0” bits, the procedure again returns to step S32 to remove theunstable status, and the same process is repeated.

As explained above, according to the embodiment shown here, it ispossible to create a number of irreversible changes in status by writingthe mark data into the OTP block without largely changing the structureof the NAND flash memory.

The invention is not limited to the above-explained embodiment. Althoughthe embodiment has been explained, taking NAND flash memory as anexample, the type of flash memory is not limited to it, the sametechnique is applicable also to other types of flash memory having thepage-writing mode, such as AND flash memory (see FIG. 44)and DINOR flashmemory (see FIG. 45), for example. Additionally, the invention is notlimited to EEPROM flash memory, but the nonvolatile semiconductor memoryin the present invention should be construed to involve any other memorysimilarly capable of storing data by its non-volatility and permittingelectrical rewrite of data, such ferroelectric memory (FRAM), forexample.

Moreover, the embodiment has been explained as the size of the OTP fieldbeing 1 block which is the minimum unit of data erasure. However, theOTP field may a plurality pages in one block or a plurality of blocks.Furthermore, the unit area for writing the mark data in the OTP fieldneed not be one byte, but any plurality of bits may be determined as theunit area. In this case, in order to provide a margin in judgement ofthe boundary area (judgement of the bland area), it is preferable thatthe number of bits is relatively large. However, in case of flash memoryexcellent in data hold property and free from the boundary areainstability, the mark data may be one bit.

Furthermore, the embodiment has been explained as setting the OTP fieldin EEPROM by providing a fuse circuit in the row decoder portion and byprogramming the fuse circuit. However, in lieu of the fuse circuit,PROM, EPROM, EEPROM, etc. permitting programming in their wafer stagecan be used. Alternatively, it may be nonvolatile semiconductor memorysetting the OTP field in the wafer process.

Additionally, the memory system to which the invention is applicableincludes memory cards, etc. equipped with a controller, such as ATAcard, compact flash, multimedia card, etc., and the invention iseffective also when creating irreversible changes of status as theentirety of the card by using irreversible changes in status of built-inflash memory, flash memory in the controller, etc. More specifically, ifNAND flash memory is mounded as the built-in flash memory, irreversiblechanges of state can be realized by the method explained in theembodiment. In ATA cards or compact flash, irreversible changes ofstatus are created or read by using a vender-unique command notregulated by the ATA standard protocol. The vender-unique command may beone for reading only the address corresponding to the current address inthe embodiment, one for incrementing the address, or a command systempermitting the OTP block in the embodiment to directly read and write.Furthermore, the same effect is expected also when these ATA cards,compact flash and multimedia cards are not perfectly irreversible forexample, even when an area corresponding to the current address in theembodiment, for example, is made of random numbers, etc.

As explained above, according to the invention, it is possible toprovide a nonvolatile semiconductor memory control method fornonvolatile semiconductor memory having a part of the memory fieldchanged into OTP, which makes it possible to store a number ofirreversible changes of status while writing the mark data in the OTPfield without erroneous writing, etc. and clearly defining the boundarybetween areas written with the mark data and areas without the data.

Although some embodiments have been disclosed for easier understandingof the invention, the invention can be realized in other various modeswithout departing from its concept therefore, the invention should beconstrued to involve all possible modes and those recited in claims notdeparting from the concept of the invention.

What is claimed is:
 1. A memory system comprising: a recording mediumstoring a data file and identifying information for restricting thecondition for using said data file; and a system apparatus permittingsaid recording medium to be removably set therein and requiring saididentifying information when reading and using thereon said data filestored in said recording medium; wherein said recording medium includesan ordinary field for storing said data file, and a redundancy field forstoring said identifying information.
 2. The memory system according toclaim 1 wherein said system apparatus approves the use of said data filestored in said recording medium when a predetermined relation isestablished between expected information said system apparatus expectsand said identifying information read from said recording medium, anddoes not approve the use of said data file when said predeterminedrelation is not established.
 3. The memory system according to claim 1wherein said recording medium is approved the use of said data filestored in said recording medium when a predetermined relation isestablished between expected information said system apparatus expectsand said identifying information stored in said recording medium, and isdisapproved the use of said data file when said predetermined relationis not established.
 4. The memory system according to claim 1 whereinsaid identifying information or information related to said identifyinginformation is incorporated into said data file stored in said recordingmedium, and said recording medium is approved the use of said data filewhen a predetermined relation is established between said identifyinginformation stored in said recording medium and said identifyinginformation or said information related to said identifying informationincorporated into said data file stored in said recording medium, and isdisapproved the use of said data file when said relation is notestablished.
 5. The memory system according to claim 1 wherein all orpart of said data file is ciphered on the basis of said identifyinginformation.
 6. The memory system according to claim 1 wherein a pseudodefective mark indicating that data in storage is not normal isintentionally recorded to at least a part of a field thereof in whichsaid data file is stored, and said system apparatus can recognize thatsaid pseudo defective mark has been intentionally recorded and said datafile is normal.
 7. The memory system according to claim 1 wherein saidredundancy field of said recording medium is configured to restrict thatdata therein is rewritten.
 8. The memory system according to claim 7wherein data stored in said redundancy field is changeable in a bitthereof from a first status to a second status but not changeable fromsaid second status to said first status, and said redundancy regionstoring said identifying information and complement information which isa complement made from said identifying information.
 9. The memorysystem according to claim 1 wherein said identifying information orinformation related to said identifying information is incorporated intosaid data file stored in said recording medium, and said systemapparatus reads out said identifying information and said data filedfrom said recording medium, said system apparatus being configured toapprove the use of said data file when a predetermined relation isestablished between said identifying information or said informationrelated to said identifying information, and not to approve the use ofsaid data file when said predetermined relation is not established. 10.The memory system according to claim 9 wherein said data file stored insaid recording medium is a file downloaded onto said recording medium byusing a terminal device.
 11. The memory system according to claim 10wherein said recording medium is capable of holding a plurality ofpieces of said identifying information.
 12. The memory system accordingto claim 9 wherein said identifying information is stored in a specialfield of said recording medium which is impossible to access orimpossible to rewrite data therein with publicly disclosed informationeven if it is accessed.
 13. The memory system according to claim 12wherein said special field is a field from which said information can beread out when said system apparatus enters a read command into saidrecording medium for reading out the specification of said recordingmedium.
 14. The memory system according to claim 12 wherein said specialfield in said recording medium is made up of a state hold circuit havinga fuse.
 15. A memory system comprising: a recording medium storing adata file acquired by download from a distribution center together withidentifying information incorporated into said data file for restrictingthe condition for using said data file; and a system apparatus permitsaid recording medium to be removably set therein and requiring saididentifying information when reading and using thereon said data filestored in said recording medium; wherein said identifying information ispersonal identifying information for identifying an individual person,and said system apparatus approves the use of said data file when apredetermined relation is established between said identifyinginformation incorporated into said data file and said personalidentifying information, but does not approve the use of said data filewhen said predetermined relation is not established.
 16. A memory systemcomprising: a recording medium storing a data file acquired by downloadfrom a distribution center together with identifying informationincorporated into said data file for restricting the condition for usingsaid data file; and a system apparatus permitting said recording mediumto be removably set therein and requiring said identifying informationwhen reading and using thereon said data file stored in said recordingmedium; wherein said identifying information is personal identifyinginformation for identifying an individual person, and said recordingmedium is approved the use of said data file when a predeterminedrelation is established between said identifying informationincorporated into said data filed stored in said recording medium andsaid personal identifying information, but is disapproved the use ofsaid data file when said predetermined relation is not established. 17.A recording medium which can be set in a system apparatus and can beremoved from the system apparatus, comprising: a data storage filed forstoring a data file; and an identifying information storage field forstoring identifying information for restricting the condition for usingsaid data file, said identifying information required when said systemapparatus reads and uses said data file; wherein said identifyinginformation storage field stores at least one pair of said identifyinginformation and complement information which is a complement createdfrom said identifying information.
 18. The recording medium according toclaim 17 wherein said identifying information in said identifyinginformation storage field is stored therein a mode disabling electricalrewrite thereof or in a mode enabling detection of a rewritten statusthereof.
 19. The recording medium according to claim 17 wherein saididentifying information is unique identifying information exclusivelyassigned to said recording medium.
 20. The recording medium according toclaim 17 wherein at least a part of said identifying information iscreated by using random numbers.
 21. The recording medium according toclaim 17 wherein said data storage field includes memory cell units eachincluding a plurality of electrically rewritable memory cells connectedto each other, and a plurality of said memory cell units are connectedto form a memory block.
 22. The recording medium according to claim 21wherein said memory cell unit is connected to at least one of a bit lineand a source line via a select gate.
 23. The recording medium accordingto claim 21 wherein said memory cell unit has a NAND cell structure inwhich a plurality of memory cells are connected in series.
 24. Therecording medium according to claim 21 wherein said data storage regioncan be erased for each memory block.
 25. The recording medium accordingto claim 21 wherein said data storage field includes pages eachincluding a plurality of electrically rewritable memory cells connectedto each other, each said page forming the unit for writing data, and aplurality of said pages being connected to form a memory block.
 26. Therecording medium according to claim 25 wherein said data storage fieldpermits erasure for each said memory block.
 27. A system apparatus inwhich a recording medium is set and used, and said recording medium onceset is removed, characterized in: said recording medium storing a datafile and identifying information for restricting the condition for usingsaid data file; and said system apparatus requiring said identifyinginformation when reading and using said data file stored in saidrecording medium; wherein said recording medium includes an ordinaryfield for storing said data file, and a redundancy field for storingsaid identifying information.
 28. The system apparatus according toclaim 27 comprising: an identifying information hold portion which holdsidentifying information for identifying said system apparatus asexpected information; and a judge portion which approves the use of saiddata file stored in said recording medium when a predetermined relationis established between said expected information expected by said systemapparatus and said identifying information read out from said recordingmedium but does not approve the use of said data file when saidpredetermined relation is not established.
 29. The system apparatusaccording to claim 27 wherein a pseudo defective mark indicating thatdata in storage is not normal is intentionally recorded to at least apart of a field thereof in which said data file is stored, and saidsystem apparatus can recognize that said pseudo defective mark has beenintentionally recorded and said data file is normal.
 30. The systemapparatus according to claim 27 wherein said redundancy field of saidrecording medium is configured to restrict that data therein isrewritten.
 31. The system apparatus according to claim 30 wherein datastored in said redundancy field is changeable in a bit thereof from afirst status to a second status but not changeable from said secondstatus to said first status, and said redundancy region storing saididentifying information and complement information which is a complementmade from said identifying information.
 32. The system apparatusaccording to claim 27 wherein said identifying information, orinformation related to said identifying information, is incorporatedinto said data file stored in said recording medium, and said systemapparatus reads said identifying information and said data file fromsaid recording medium and approves the use of said data file when apredetermined relation is established between said identifyinginformation and said information or information related to saidinformation incorporated into said data file, but does not approve theuse of said data file when said predetermined relation is notestablished.
 33. The system apparatus according to claim 32 wherein allor part of said data file is ciphered on the basis of said identifyinginformation.
 34. The system apparatus according to claim 32 wherein saiddata file stored in said recording medium is a file downloaded onto saidrecording medium by using terminal device.
 35. The system apparatusaccording to claim 34 wherein said recording medium can hold a pluralityof pieces of said identifying information.
 36. The system apparatusaccording to claim 32 wherein said identifying information is stored ina special field of said recording medium which is impossible to accessor impossible to rewrite data therein with publicly disclosedinformation even if it is accessed.
 37. The system apparatus accordingto claim 36 wherein said special field is a field from which saidinformation can be read out when said system apparatus enters a readcommand into said recording medium for reading out the specification ofsaid recording medium.
 38. The system apparatus according to claim 36wherein said special field in said recording medium is made up of astate hold circuit having a false.
 39. A recording medium which can beset in a system apparatus and can be removed from the system apparatus,comprising: a data storage filed for storing a data file; and anidentifying information storage field for storing identifyinginformation for restricting the condition for using said data file, saididentifying information required when said system apparatus reads anduses said data file; wherein said data storage field includes pages eachincluding a plurality of electrically rewritable memory cells connectedto each other, each said page for the unit for writing data, and aplurality of said pages being connected to form a memory block; whereinsaid redundancy field of said recording medium is configured to restrictthat data therein is rewritten; and wherein said identifying informationthe apparatus number of said system apparatus.
 40. A recording mediumwhich can be set in a system apparatus and can be removed from thesystem apparatus, comprising: a data storage filed for storing a datafile; and an identifying information storage field for storingidentifying information for restricting the condition for using saiddata file, said identifying information required when said systemapparatus reads and uses said data file; wherein said data storage fieldincludes pages each including a plurality of electrically rewritablememory cells connected to each other, each said page forming the unitfor writing data, and a plurality of said pages being connected to forma memory block; wherein said redundancy field of said recording mediumis configured to restrict that data therein is rewritten; and whereinsaid identifying information is personal identifying information foridentifying an individual person.
 41. A control method for controllingnonvolatile semiconductor memory having a memory cell array made of anarrangement of electrically rewritable nonvolatile memory cells, a partof said memory cell array forming a state change storage fieldpermitting data to be written only once, said state change storage fieldincluding a plurality of pages each divided into a plurality of unitareas, comprising: a first step for detecting that said nonvolatilesemiconductor memory experienced a predetermined operation causing achange of state thereof, a second step for writing a mark data in one ofsaid unit areas in said state change storage field when saidpredetermined change of state is detected; and a third step forsequentially searching said plurality of unit areas in said state changestorage field to find out a final unit area in which said mark data waswritten last; wherein said unit area in said state change storage fieldis made up of a plurality of bits, and said second step changes all ofsaid plurality of bits in said unit area into a second state when saidmark data is written in one of said unit areas.
 42. The control methodaccording to claim 41 wherein said second step writing said mark data inthe unit area at an address subsequent to said final unit area.
 43. Thecontrol method according to claim 41 wherein, upon sequentiallysearching said plurality of unit areas, said third step counts thenumber of bits taking said second state in each unit area, and when thecount value exceeds a certain value, it judges that said mark data wasalready written in said unit area.
 44. The control method according toclaim 41 wherein, in said memory cell array, a region of an arrangementof memory transistors aligned along a single control gate lineconstitutes one page, and a region of a plurality of said pagesincluding a plurality of memory transistors selected by differentcontrol gate lines and connected in series to form a NAND cell form oneblock which is the minimum unit for data erasure.
 45. The control methodaccording to claim 41 further comprising: a fourth step for judging thestability of data in said unit area not yet written with said mark dataat an address adjacent to said unit area written with said mark data insaid second step, and for precedently writing said mark data in saidunit area not yet written with said mark data and judged to be unstable.46. The control method according to claim 45 wherein judgement of thestability of data in said unit area not yet written with said mark datain said fourth step is to count the number of bits taking said secondstate and to judge said unit area to be unstable when the count valueexceeds a certain value.
 47. The control method according to claim 41wherein, in said memory cell array, memory transistors each having afloating gate and a control gate are arranged to form a matrix, a rangeincluding a plurality of said memory transistors aligned in a columndirection along a single control gate line commonly connecting saidcontrol gates form one page, and a range of a plurality of pagesincluding a plurality of said memory transistor selected by differentcontrol gate lines and aligned in a row direction and then connected toa bit line through a selection gate to form a NAND cell form one blockwhich is the minimum unit of data erasure.
 48. The control methodaccording to claim 47 wherein a bit line is connected to one end of saidNAND cell and a source line is connected to the other end, saidplurality of unit areas in said state change storage field are assignedwith addresses in an incremental sequence from one nearest to saidsource line toward one nearest to said bit line with respect to the rowdirection, and assigned in an incremental sequence from one end towardthe other end with respect to the column direction.
 49. A memory device,comprising: a data storage area configured to be capable of storing atleast one encrypted data file, the data storage area being required tobe readable and writable from outside of the memory device; and anidentifying information storage area configured to store identifyinginformation for using the at least one encrypted data file, theidentifying information storage area being prohibited from beingaccessed from outside of the memory device, wherein the memory deviceincludes a plurality of blocks, each of the plurality of the blocks is aunit of data erasing, and at least one of the plurality of blocks isallocated to the data storage area and the identifying informationstorage area, respectively; and the identifying information is based ona chip ID of the memory device and is unique to the memory device.
 50. Amemory card, comprising: a memory device including a plurality ofblocks, each of the plurality of the blocks being a unit of data erasingand including a plurality of pages, each of the plurality of pagesincluding a plurality of electrically rewritable memory cells where thememory cells share a word line extending over the memory cells; and acontroller including a buffer and coupled with the memory device,wherein the memory device includes: an identifying information storagearea storing identifying information based on a chip ID of the memorydevice, the identifying information storage area being prohibited frombeing accessed from outside of the memory device; and a data storagearea being capable of storing an encrypted data file which is associatedwith the identifying information, the data storage area being requiredto be readable and writable from outside of the memory device.
 51. Thememory device according to claim 49, wherein the identifying informationis stored with an error correction code.
 52. The memory device accordingto claim 49, wherein the identifying information is stored with a paritycode.
 53. The memory device according to claim 49, wherein theidentifying information is duplicated in the identifying informationstorage area.